For batch correlation, our processes are generally identical and parallel. A string is produced by an encoder, passes through the AND switches, is rewritten by the DCMs and then sent by transmoders to the datacentres where it is delivered by another DCM. We have to do this more than 30 times for all our chains. Hence the batch correlation rules.
An event on the coder impacts the whole workflow the aim is to limit the number of emails in order to gain in efficiency.
Thank you in advance if you have a solution.
Not sure I understand the question correctly, but it seems to me that you can collect all your alarms in a correlation rule by applying the necessary filters under 'Alarm Filter' and then select 'Send email' under 'Actions'.
For instance, when I use the following alarm filters
I will get an email as soon as there is at least one alarm on an element with protocol 'QA Basic Combination'. I won't get any additional email for any other alarm on that protocol until all alarms first get cleared, and then a new alarm on that protocol is generated.
Does this answer your question, or am I being too simplistic?
Is it an option to put each chain in a separate service? Or is there some other way you can identify the chain based on the alarm (alarm property?, element property?, table index?, …)? If so, you can make sure that the alarm filter catches all possible alarms for all chains, and then use the 'Alarm Grouping' option to group the alarms per chain. This should give you one email per chain that fails.
This is not a 100% answer to my request.
I'll try to explain it differently.
We have a chain of devices that impact on each other. We currently have one e-mail per device for errors. As a result, we receive an incredible number of errors.
Example: Device 1 (DCM) sends a string –> To a switch –> Device 2 (DCM) –> Transcoder –> DataCenter.
If Device 2 fails, the whole chain is affected, and so on.
This manipulation is performed more than 30 times for all strings.