Correlation rule – When there is more than 10 alarms – Group by element

Solved1.42K viewsCorrelation group
1
0 Comments

Dear Dataminer Dojo,

In the correlation rules, I was wondering if it is possible to add in this following condition :
- When we have more than 10 alarms on one element, I would like to group those alarms.

I have tried to add the Rule Condition, with count(*) < 10, however it is not related to one element and I wasn't able to group by element in the Rule Condition.

If any one has an idea, do not hesitate.

Thanks in advance,

Laurine

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 18th July 2023

2 Answers

2
9.06K 2 Comments

Hi Laurine, your first step would be to group incoming alarms by element.  Because the evaluation is then done on an element basis.  Can you make sure that this is set up like this at the top of your correlation definition?

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 18th July 2023
Wouter Demuynck [SLC] [DevOps Advocate] commented

as a note: don’t enable the “trigger on single events” checkbox for this rule, as it will not keep track of the active alarms per elements if you do.
Ben Vandenberghe [SLC] [DevOps Enabler] commented

Correct Wouter, well-spotted. Apologies for that, I just wanted to depict the drop down with the selection of that specific ALARM GROUPING option. Thanks!
0
20 2 Comments

Hi Ben,
Thanks for your answer.
My issue with this option is on one element I have different services.
If there is 2 services on alarm on one element I still want the correlated alarms to be launch for the 2 services.
However if I have more than 10 alarms on the same element, I would like to group it.
Maybe this is not possible and I will have to create two different correlation rule.

Wouter Demuynck [SLC] [DevOps Advocate] Posted new comment 16th September 2021
Ben Vandenberghe [SLC] [DevOps Enabler] commented

Hi Laurine, I’m not sure if I can quite follow here. When you refer to services, I assume you refer to a DataMiner service? So you are talking about a correlated alarm to launch for the 2 services, you are referring to another correlation logic that you apply? And now you also want to apply another one, where you have a correlated event when there are more than 10 alarms on an element?
Wouter Demuynck [SLC] [DevOps Advocate] commented

In general, some possibilities with the correlation engine:

– a rule can keep track of active alarms matching a condition and execute actions on those (e.g. if an element has > 10 active alarm trees, group these into a correlated event)
– multiple rules can be defined on top of the same alarm trees
– it is possible to define rules that operate on correlated events that were generated through other rules (requires the rule to have the “Accept Correlation alarms” option to be enabled)

Depending on what you want to achieve, you might need to combine multiple rules.