Assure1 Supervised Event Correlator microservice¶
Overview¶
The Assure1 Supervised Event Correlator microservice is part of the RCA3 solution. The Supervised Event Correlator takes Supervised Correlation Policies, runs supervised machine learning algorithms, identifies an existing root cause event or creates a new root cause event, and correlates the remaining symptom events to the root cause event.
Prerequisites¶
- A microservices cluster must be setup. Refer to Microservice Cluster Setup.
Setup¶
su - assure1
export NAMESPACE=a1-zone1-pri
export WEBFQDN=<Primary Presentation Web FQDN>
a1helm install supervised-event-correlator assure1/supervised-event-correlator -n $NAMESPACE --set global.imageRegistry=$WEBFQDN
Default Configuration¶
| Name | Value | Possible Values | Notes |
|---|---|---|---|
| LOG_LEVEL | INFO | FATAL, ERROR, WARN, INFO, DEBUG | Logging level used by application. |
| CONFIG_CHECK | 900 | Integer | Time in seconds between config checks (reading in of new / changed policies). This number should be bigger than poll time. |
| POLL_LAST | 300 | Integer | Time in seconds to check every poll time. This number should not be smaller than the poll time to avoid gaps |
| POLL_TIME | 300 | Integer | Time in seconds between polls of the event list (and processing of events) |
Configurations can be changed by passing the values to the a1helm install prefixed with the configData parent key.
CONFIG_CHECK, POLL_LAST and POLL_TIME need to be set using --set-string.
Example of setting the log level to DEBUG and poll time to 60¶
a1helm install ... --set configData.LOG_LEVEL=DEBUG --set-string configData.POLL_TIME=60
Policy Setup¶
Add Supervised Correlation Policies or modify existing Supervised Correlation Policies:
Configuration -> Events -> Supervised Correlations
Supported Meta Event Tokens¶
The following table shows the supported meta event tokens.
| Keyword | Description |
|---|---|
$ACTOR |
Supervised Correlation policy name |
$ACTION |
event-supervised-correlator |
$GROUPBY |
Supervised Correlation policy Group BY value if set. Else: Empty |
$POLICYID |
Supervised Correlation policy ID |
$POLICYNAME |
Supervised Correlation policy name |
$STARTTIMESTAMP |
Timestamp of first (oldest) event in cluster |
$TIMESTAMP |
Timestamp Meta Event got created / renewed |