Moogsoft Docs

Auto Close

The Moogsoft AIOps Auto Close feature lets you define criteria for automatically closing alerts and Situations.

Auto Close enables you to use filtering rules to organize your data and keep it current so you can focus on the most important active alerts and Situations. You will also see performance improvements because automatically closing old alerts and Situations reduces the amount of data involved in AIOPs statistic calculations.

Auto Close lets you define the conditions using filters and determine how often AIOps checks which alerts and Situations to close . Any alerts and Situations older than a certain time and that meet the defined criteria are closed.

Configure Auto Close for Situations

The Housekeeper Moolet must be configured and running within moogfarmd in order for Auto Close to work. To configure which Situations should never be auto closed, create an exclusion filter as follows:

  1. Click Edit Filter to open the filter editor.
  2. Clear the filter using Empty Filter and Add Clause . Alternatively, you can manually type in your filter rules. See Filter Search Data for reference.
  3. Apply the changes to continue and click Done .

After you add the filter , define the behavior for automatically closing Situations as follows:

  • Close the Situation and all of the alerts it contains
  • Close the Situation and all unique alerts it contains. Unique alerts are any alerts that are not part of any other Situations.
  • Close the Situation only.

You can create tasks to configure:

  • The age when Situations are suitable for Auto Close.
  • The number of Situations to close in each Auto Close run.
  • Situations only close if all associated alerts are closed.

Edit the default task or click Add Task . The available settings are as follows:

Setting UI Text Input Options Description

Situation Age

When they are older than

Integer

Minutes
Hours
Days

Defines the age of the Situation before it can be closed. Must be a number greater than 1 .
All Alerts closed And when all alerts in the Situation are closed Boolean - If enabled, o nly Situations with no open alerts qualify for automatic closure.
Match filter And all Situations match the following filter Filter - Defines the criteria a Situation must meet to qualify for automatic closure
Batch size Every time this task runs, close a maximum of Integer -

Defines the maximum number of Situations to auto close in each Auto Close run. 1000 by default.
Must be a number greater than 1.

Once saved, the Auto Close task runs after a set period of time. This time period is between five minutes and four hours depending on the age of the Situation.. The older the Situation age, the closer the frequency of the task gets to four hours (see the example below).

There is no limit on the number of tasks, so you can add any as many as you need meet your requirements.

The example below demonstrates how you can a configure an Auto Close task to close a maximum of 1000 Situations per run that meet the following criteria:

  • Older than 23 hours
  • All associated alerts are closed
  • Have a clear severity.

Configure Auto Close for Alerts

To configure which Alerts should never be auto closed, select the Alerts tab and create an exclusion filter as follows:

  • Click Edit Filter to open the filter editor.
  • Clear the filter using Empty Filter and Add Clause . Alternatively, you can manually type in your filter rules. See Filter Search Data for reference.
  • Apply the changes to continue and click Done .

You can create tasks to configure:

  • The age when Alerts are suitable for Auto Close.
  • The number of Alerts to close in each Auto Close run.

Edit the default task or click Add Task . The available settings are as follows:

Setting UI Text Input Options Description
Alert age When they are older than

Integer

Minutes
Hours
Days

Defines how old the alert must be to be auto closed. Must be a number greater than one.

Match filter And all alerts match the following filter Filter - Defines which alerts to include in the batch being auto closed.
Batch size Every time this task runs, close a maximum of Integer -

Defines the maximum number of alerts to auto close in each Auto Close run.
Must be a number greater than one.
This is 1000 by default.

Once saved, the Auto Close task runs after a set period of time. This time period is between five minutes and four hours depending on the age of the alert. The older the alert age, the closer the frequency of the task gets to four hours.

There is no limit on the number of tasks, so you can add any as many as you need meet your requirements.

The task example below demonstrates how you can configure a task to Auto Close a maximum of 1000 alerts per run that meet the following criteria:

  • Older than 45 minutes
  • Have a clear severity or a minor severity.