Hello,
We aim to have a single information event that will group all alarms with a specific value.
When we define the rule and have a alarm console tab page that combines Active alarms and Information events, we see that the correlated information alarm is created multiple times.
From the Root Alarm ID I can see that a new correlated information alarm is generated when there is an update in at least one of the matching alarms.
- What is the expected behavior?
Additionally it also creates 2 entries every time the rule triggers
- What is the expected behavior?
The correlation rule has "auto clear" enabled in the actions section. I would expect the the information alarm to be removed when all matching alarms are cleared. But this is not the case, the information is never removed.
- When will the correlated information alarm be removed from the console?
I would also expect the Parameter Description value of the correlated alarm to be the same as the base alarm, but it is using the table name.
Current result with duplicate information alarms:
Alarm console settings: History tracking, Correlation tracking, Automatically remove cleared alarms.
Correlation rule:
DataMiner (10.1.11.0-11105-CU1)
Hi Mieke,
To my knowledge, information events are automatically cleared as soon as they are generated. This would also mean there's no active alarm tree for an information event, and -as a result - it cannot be updated.
So, if one of the matching alarms is updated, the correlation engine will not find an active correlation alarm and will generate a new alarm instead. However, I realize this doesn't explain why an alarm update generates two correlation alarms.
Nevertheless, I don't think having the options 'auto clear' and 'update base alarms' make sense when the correlation alarm is an information event.
In the alarm console, I don't think your information events will ever be removed. After all, the information events in the default alarm tab "Information Events" are also kept as long as you're logged in.
It would be interesting to know if you get the desired result when the severity of the correlation alarm is different than 'Information'.
I would recommend going for a different setup if at all possible.
I'm going to join Jan-Klaas in his answer and say that Auto Clear is not going to work here. It might for masked information events under some circumstances, since masked info events were not cleared automatically until unmasked. (though I'm not sure it's still the case since the rework of the masked state)
This would also explain why the information event keeps getting generated over and over again. DataMiner simply has no reference to one existing, it is only the client that shows them.
Perhaps it might be interesting to explore what the purpose is of this configuration so that we might figure out something equally useful?
When using “Warning” instead of “Information” there are no duplicates.
And when all the alarms clear, the correlated alarm also clear.
So this seems to behave as expected for our use case.