We want to correlate two alarm states coming from two elements. When testing the necessary configuration in stand-alone correlation rules, they are working just fine (nevermind the redundant levels, that's no issue). However, when combining exactly the same arguments with an AND, then the resulting rule does not work.
Rule 1 (working):
Rule 2 (working):
Rule 3 (NOT working):
What might be the issue here?
Thanks!
Hi Nils,
I assume the filter displayed here is the "Alarm filter" section of the correlation rule.
Be aware that this filter gets applied to every individual alarm tree, in order to select which alarms to gather for the rule. In this case, the AND filter requests the element to be part of two elements at once, which will never be a match.
Alarms that match the filter get added to the bucket of alarms for the rule.
The rule bucket tracks active alarm trees that match the alarm filter. Whether the correlation rule actually triggers and executes actions is defined in the rule conditions.
You'll probably need to use "OR" in the Alarm Filter to capture both types of alarm events and then use filter conditions in the Rule Conditions to indicate that you want at least one alarm from element A and one from element B before the rule actually executes actions.
I hope this makes somewhat sense.
More information on configuring correlation rules can be found in DataMiner Docs.
Relevant logfile here is SLCorrelation.txt. It typically contains logging on which alarms are accepted for which rule and when conditions to fire actions are matched (when log levels for this "Correlation" logfile have been set to "Log everything (5)").
UPDATE 2023-03-13: Example config
Hi Nils, if it can be of any help, I’ve updated the answer above with screenshots for an example configuration. Hopefully this can help you further
Hi Wouter,
thanks for adding the example config… I believe it was a minor misunderstanding on my side how to configure the Rule Condition. Indeed this is now working as expected – thanks a lot for your help! 🙂
Hi Wouter,
thanks for your input! Correct, it is the “Alarm filter” section. And you are right, with an OR this filter indeed matches.
However, when trying to follow your advice and make use of the “Rule Condition”, I have no success. If I understand correctly, then in the “Rule Condition” the same filter has to be applied which I’ve posted in my question (or, at least, one of the two parts – preferably that one which is complementary to the one used in the “Alarm filter” section).
Basically the logical implementation (IF/AND/OR) in the “Rule Condition” section shows the same behaviour as in the “Alarm filter” section.
So far I have found no solution…