Assure1 Event Root-Cause Analysis (RCA) Connector

Overview

The Assure1 Event Root-Cause Analysis (RCA) Connector is primarily concerned with relationships and it monitors the event stream while leveraging an existing network hierarchy defined in the Orient Database to determine where an issue started and suppress downstream device alerts.

For example, assume a router is connected to two switches, which then have servers connected to the switches. If the router goes down, alerts will be generated for all of the devices in the network that are unreachable, but the connector will suppress the downstream device events while keeping the router event the same.

Root-Cause Analysis (RCA) Connector

1. The connector requires that a hierarchy of relationships for devices be defined in the Orient Database. Refer to the Orient Database section for an example on how to define a device relationship model. Graph Database and Topology

2. Enable the default Service, unless a specific configuration option is needed.

   Configuration -> Broker Control -> Services

Default Service

Field	Value
Package Name	coreProcessing-app
Service Name	Event Root Cause Analysis (RCA)
Service Program	bin/core/processing/RCAConnectord
Service Arguments
Service Description	Root Cause Analysis (RCA), custom processing and analysis of event data
Failover Type	Standalone (Supported: Standalone, Primary/Backup)
Status	Disabled
Privileged	(Checked)

Default Configuration

Name	Value	Possible Values	Notes
BaseRules	processing/event/rca/base.rules	Text, 255 characters	Relative path to Base Rules.
BranchDir	core/default	Text, 255 characters	Relative path to Rules directory.
IncludeRules	processing/event/rca/base.includes	Text, 255 characters	Relative path to Include Rules.
LoadRules	processing/event/rca/base.load	Text, 255 characters	Relative path to Load Rules
LogFile	logs/EventRCAConnector.log	Text, 255 characters	Relative path to Log File.
LogLevel	ERROR	OFF, FATAL, ERROR, WARN, INFO, DEBUG	Logging level used by application.
PollTime	60	Integer	Interval in seconds in which the connector polls for possible events to be processed.
SelectSQLFile	processing/event/rca/events.sql	Text, 255 characters	Relative path to SQL file containing database query.
ShardID	1	Integer	Events Database shard to use. 0 to read from all shards
EdgeTypeID		Integer	Optional - Combobox of available Edge Types. Directed orient link type to use when determining parent devices. Requires GenericDatabaseStitcher.md to have been run. Should be either "HasPrimaryPerspective" or "HasSecondaryPerspective".

Rules

This connector uses the Assure1 standard rules architecture. The rules are written in Perl syntax. Refer to the following guides for details on rules creation:

• Core Rules Functions

• Event Rules Functions

• Graph Rules Functions

• Application Logging

Tokens

The connector exposes the following tokens for rules processing.

Token	Description
$EventRow	Resulting data from query. Use $EventRow->{'FieldName'} to access the "FieldName" data. Each row contains the reserved data field ShardID which is the ShardID it was read from.
$EventDBHandles	Database handle hash containing open connections for all configured shards keyed by shardID. ShardID is available from the event e.g. $EventDBHandles->{ $EventRow->{ShardID} } to get the database connection for the event's shard. Passed into rules functions to update the event, etc.
$AppConfig	Hash reference to the application configuration name-value pairs that were configured. (i.e. use $AppConfig->{'Host'} to retrieve the set value for 'Host'.)
$CustomHash	Custom key, value cache available across all rules. Contents commonly defined in Load Rules then used in Base or other rules. NOTE: This variable is a shared object and any additional sub hashes or arrays must be shared before use or it will cause the error: "Invalid value for shared scalar". Instantiate the sub hash/array using '&share({})' e.g. $CustomHash->{SubObject} = &share({});
$StorageHash	Internal cache used as the StorageHash option when calling rules functions such as FindDeviceID(). NOTE: The structure of this cache is subject to change! Not recommended for custom global storage or manual manipulation; use $CustomHash.
$RulesDBH	Assure1 Database Handle. Used by rules function to lookup information, create and update records, etc.

Administration Details

The following list shows the technical details needed for advanced administration of the application:

• Package - eventRCA-app

• Synopsis - ./RCAConnectord [OPTIONS]

• Options:

   -c, --AppConfigID N   Application Config ID (Job ID)
   -?, -h, --Help        Print usage and exit
  

• Threaded - Single Threaded