Supervised Event Correlator

Overview

The Unified Assurance Supervised Event Correlator microservice is part of the RCA3 solution. The Supervised Event Correlator takes Supervised Correlation Policies, runs supervised machine learning algorithms, identifies an existing root cause event or creates a new root cause event, and correlates the remaining symptom events to the root cause event.

Prerequisites

  1. A microservices cluster must be setup. Refer to Microservice Cluster Setup.

Setup

su - assure1
export NAMESPACE=a1-zone1-pri
export WEBFQDN=<Primary Presentation Web FQDN> 
a1helm install supervised-event-correlator assure1/supervised-event-correlator -n $NAMESPACE --set global.imageRegistry=$WEBFQDN

Default Configuration

Name Value Possible Values Notes
LOG_LEVEL INFO FATAL, ERROR, WARN, INFO, DEBUG Logging level used by application.
CONFIG_CHECK 900 Integer Time in seconds between config checks (reading in of new / changed policies). This number should be bigger than poll time.
POLL_LAST 300 Integer Time in seconds to check every poll time. This number should not be smaller than the poll time to avoid gaps.
POLL_TIME 300 Integer Time in seconds between polls of the event list (and processing of events).
REDUNDANCY_POLL_PERIOD 5 Integer How often the secondary service checks to see if the primary is online, in seconds.
REDUNDANCY_FAILOVER_THRESHOLD 4 Integer The number of failed polls before the secondary becomes the active application.
REDUNDANCY_FALLBACK_THRESHOLD 1 Integer The number of successful polls before the secondary goes back to sleep.

Configurations can be changed by passing the values to the a1helm install prefixed with the configData parent key.

CONFIG_CHECK, POLL_LAST and POLL_TIME need to be set using --set-string.

Example of setting the log level to DEBUG and poll time to 60

a1helm install ... --set configData.LOG_LEVEL=DEBUG --set-string configData.POLL_TIME=60

Example of enabling redundancy

Redundancy will not be enabled by default. To enable this functionality, pass the following to the install command:

a1helm install ... --set redundancy.enabled=true

Policy Setup

Add Supervised Correlation Policies or modify existing Supervised Correlation Policies:

Configuration -> Events -> Supervised Correlations

Supported Meta Event Tokens

The following table shows the supported meta event tokens.

Keyword Description
$ACTOR Supervised Correlation policy name
$ACTION event-supervised-correlator
$GROUPBY Supervised Correlation policy Group BY value if set. Else: Empty
$POLICYID Supervised Correlation policy ID
$POLICYNAME Supervised Correlation policy name
$STARTTIMESTAMP Timestamp of first (oldest) event in cluster
$TIMESTAMP Timestamp Meta Event got created / renewed