Skip to content
DataMiner Dojo

More results...

Generic selectors
Exact matches only
Search in title
Search in content
Post Type Selectors
Search in posts
Search in pages
Search in posts
Search in pages
Log in
Menu
  • Updates & Insights
  • Questions
  • Learning
    • E-learning Courses
    • Empower Replay: Limited Edition
    • Tutorials
    • Open Classroom Training
    • Certification
      • DataMiner Fundamentals
      • DataMiner Configurator
      • DataMiner Automation
      • Scripts & Connectors Developer: HTTP Basics
      • Scripts & Connectors Developer: SNMP Basics
      • Visual Overview – Level 1
      • Verify a certificate
    • YouTube Videos
    • Solutions & Use Cases
      • Solutions
      • Use Case Library
    • Agility
      • Book your Agile Fundamentals training
      • Book you Kanban workshop
      • Learn more about Agile
        • Agile Webspace
        • Everything Agile
          • The Agile Manifesto
          • Best Practices
          • Retro Recipes
        • Methodologies
          • The Scrum Framework
          • Kanban
          • Extreme Programming
        • Roles
          • The Product Owner
          • The Agile Coach
          • The Quality & UX Coach (QX)
    • >> Go to DataMiner Docs
  • DevOps
    • About the DevOps Program
    • Sign up for the DevOps Pogram
    • DataMiner DevOps Support
    • Feature Suggestions
  • Swag Shop
  • Downloads
  • PARTNERS
    • All Partners
    • Technology Partners
    • Strategic Partner Program
    • Solutions
    • Deal Registration
  • Contact
    • Sales, Training & Certification
    • DataMiner Support
    • Global Feedback Survey
  • >> Go to dataminer.services

Correlation – Sliding Window behavior

64 views2 days agoCorrelation sliding window
2
Catarina Grilo [SLC] [DevOps Enabler]1.75K 3 days ago 0 Comments

Hi Dojo,

I'm trying to set up a correlation rule using a sliding window, so I'm expecting that as soon as there are enough occurrences in the interval, the rule will be triggered.

My rule is very simple: I filter for alarms that belong to only one element, and in the rule condition I defined that only warning alarms should trigger the rule, and this is immediately evaluated. Then I have my sliding window that requires at least 4 occurrences in 3 minutes for the rule to be triggered, which will generate a new alarm:

However, this is not working. For example, when I already have five warning alarms in the element, the correlated alarm is not created:

Looking into the correlation logs, it seems that the alarms are being added to the bucket but not counting as occurrences. I'm guessing this is because I don't have the trigger on single events, so the alarms go through the alarm filter (enter the bucket) but even though they match the rule condition, they don't seem to be evaluated by it.

Is this expected behavior? I ask this because if I use a trigger on single events, the rule works but if there are more occurrences than the defined ones, there will be another correlated alarm, which is grouping the alarms with the new one, which does not seem correct:

Is this expected behavior?

Miguel Obregon [SLC] [DevOps Catalyst] Answered question 2 days ago

1 Answer

  • Active
  • Voted
  • Newest
  • Oldest
0
Miguel Obregon [SLC] [DevOps Catalyst]19.90K Posted 2 days ago 1 Comment

Hi Catarina,

Having a look at DataMiner Docs, I found the following note:

If, for instance, you want to create a rule that is triggered if a certain number of alarms occur within a sliding window, you must also select the option Trigger on single events. Don’t maintain active tree status in the Alarm filter section.

Can you try enabling this option and validate if the correlation rule is triggered?

Hope it helps.

Catarina Grilo [SLC] [DevOps Enabler] Posted new comment 2 days ago
Catarina Grilo [SLC] [DevOps Enabler] commented 2 days ago

Hi Miguel,
Thank you for your answer. However, as I mentioned in my question, when I enable "trigger on single events", the rule does get triggered correctly, but if the number of occurrences exceeds the one defined in the sliding window, a new correlated alarm is created. This new correlated alarm ends up grouping the new occurrence along with the previously correlated ones, which results in what appears to be "duplicate correlated alarms". You can refer to the last screenshot I included in my original message for a clear example of this behavior.

Please login to be able to comment or post an answer.

My DevOps rank

DevOps Members get more insights on their profile page.

My user earnings

0 Dojo credits

Spend your credits in our swag shop.

0 Reputation points

Boost your reputation, climb the leaderboard.

Promo banner DataMiner DevOps Professiona Program
DataMiner Integration Studio (DIS)
Empower Katas
Privacy Policy • Terms & Conditions • Contact

© 2025 Skyline Communications. All rights reserved.

DOJO Q&A widget

Can't find what you need?

? Explore the Q&A DataMiner Docs

[ Placeholder content for popup link ] WordPress Download Manager - Best Download Management Plugin