Moogsoft Docs

Release Notes

Moogsoft AIOps v6.5.0 ESR

Moogsoft AIOps v6.5.0 is an Enterprise Stability Release that introduces the following key features:

Vertex Entropy : Moogsoft AIOps includes a new topology calculation that identifies the most critical nodes in your network and their tendency to generate important events.

New Tarball Installer : A simplified installation process doesn't require RPM or yum so you don't need root access for new Moogsoft AIOps deployments.

Enrichment Feature : The Integrations UI includes a new enrichment feature that enables you to enrich your alerts with data from another data source.

New Login Page : The Moogsoft AIOps login screen has been redesigned and now features a background image.

High Availability for LAMs : The LAM integrations now incorporate the same high availability (HA) functionality as Moogfarmd. When you enable automatic_failover in system.conf and the system detects that an active LAM has failed, a passive LAM for the same process group becomes active and takes its place. Integrations installed from the Moogsoft AIOps UI do not support high availability.


The latest version of Moogsoft AIOps v6.5.0 is v6.5.0.10. This contains the following bug fix:

  • MOOG-13282: A library upgrade for a security issue within the Jackson library.

Refer to Moogsoft AIOps v6.5.0 Updates for details on previous updates to this version.

Install & Upgrade

To perform a new Moogsoft AIOps installation without root user access, see Single Host Installation for Non-root Users .

To perform a new installation, see Pre-install RHEL 6 or Pre-install RHEL 7/CentOS 7 then follow the instructions for one of the following:

Supported upgrade paths for this version include:

Users on the Edge upgrade path can upgrade to this release and treat it as a stepping stone to future Edge releases (e.g. 6.5.1, 6.5.2, ...).

This release uses the moog_db_auto_upgrader to upgrade the database and run any 'data migration utilities'.

The following components have been upgraded in this release to the versions listed:

  • Elasticsearch 5.6.9
  • Java 1.8.0_171
  • MySQL Community Server 5.7.22
  • Nginx 1.14.0 or above
  • RabbitMQ 3.7.4

For more information see Moogsoft AIOps 6.5.0 Supported Environments .

Release Highlights

Key Feature Release Note
MOOG-9020 Vertex Entropy

Vertex Entropy is a new Moogsoft AIOps algorithm that allows you to identify the most critical nodes in your network and their tendency to produce important events.

Once the Vertex Entropy calculation is run against a topological map of the connected nodes in your network, it applies a Vertex Entropy value for each node or "vertex". You can configure several Vertex Entropy filters in Cookbook to cluster alerts into Situations based on their topological importance.

Vertex Entropy is a beta feature. For more information see Vertex Entropy .

MOOG-4884 New (Non-root) Tarball Installer

The installation process has been improved and simplified:

  • You can now install Moogsoft AIOps as a non-root user.
  • You do not need to use a package manager such as RPM or yum, although this method is still supported.
  • All third-party dependencies apart from MySQL are now bundled as part of the installation.
  • If running a distributed installation, you can use the new process_cntl utility to start components for each host.

The new Installer is hosted on our 'speedy' yum repository:
Contact for access if you do not already have an account.

MOOG-7236 Enrichment

The optional enrichment feature can be used to integrate alert data with other data sources. Enrichment can:

  • Improve readability of alerts for operators
  • Improve accuracy for clustering alerts into Situations

Enrichment is an alpha feature. For more information see Enrichment .

MOOG-8831 Historic Data Store New installations employ two databases, an active database and a historic database to enhance performance of the UI and extend data retention capabilities. Upgrading customers can manually split the database to benefit from using a separate historic database. For more information see Historic Data Store .
INT-3816 High Availability Integrations Integrations (LAMs) now incorporate the same high availability (HA) functionality as Moogfarmd. When you enable automatic_failover in system.conf and the system detects that an active integration has failed, a passive integration for the same process group becomes active and takes its place. If you disable the configuration, you can run the int independently without database connectivity.
- New Integrations

A number of new integrations have been added and improved. These include:

  • A new Slack integration allowing Moogsoft AIOps to send messages to a specific Slack channel.
  • A new xMatters integration that enables bidirectional communication between Moogsoft AIOps and xMatters.
  • A new AWS Simple Notification Service (SNS) integration allows you to post data to Moogsoft AIOps when there is a CloudWatch alarm.
  • The ITSM integrations (JIRA, JIRA Service Desk, Remedy, ServiceNow and Cherwell) have been updated with an auto-assignment option so the ticket creator is automatically assigned a new ticket.
  • Support has been added for SNMPv3. See SNMPv3 .

New Features

Key Release Note

Probable root cause (PRC) labels can be retrieved and set using Graze and MoogDb with getPrcLabels and setPrcLabels. For more information see Graze API Endpoints and MoogDb V2 .


A new Noise Reduction dashboard has been added as part of the dashboards and reporting integration with Grafana. For more information see Grafana Dashboards .

New Stats API endpoints added as part of this dashboard include:

  • Stats API endpoint getNewSituationsStats has been added to retrieve the number of new Situations.
  • Stats API endpoint getAlertsInNewSituations has been added to retrieve the total numbers of alerts in new Situations.
  • Stats API endpoint getNewEventsStats has been added to retrieve the number of new events.
  • Stats API endpoint getNewAlertsStats has been added to retrieve the number of new alerts.
  • Stats API endpoint getNewEventsPerAlertsStats has been added to retrieve the percentage event to alert noise reduction.
  • Stats API endpoint getNewAlertsPerSituationsStats has been added to retrieve the percentage alert to Situation noise reduction.
  • Stats API endpoint getNewEventsPerSituationsStats has been added to retrieve the percentage noise reduction.

The $MOOGSOFT_HOME/bin/utils/ script has been updated so that Moogsoft AIOps now works with a remote copy of MySQL, RabbitMQ, or Elasticsearch.

  • To install Moogsoft AIOps using non-Moogsoft RabbitMQ, add the following to the moog init command:

    To install Moogsoft AIOps using non-Moogsoft MySQL, add the following to the moog init command:

    --database=<host:port> --user=<user> --password=<password>

    To install Moogsoft AIOps using non-Moogsoft Elasticsearch, add the following to the moog init command:


Vertex Entropy: A new calculation that allows you to identify the most critical nodes in your network and their tendency to produce important events.

This includes the following new features:

  • A new graph_analyser utility has been added for calculating Vertex Entropy values, indicating how important a node is in a network. The utility must be run after a topology has been imported into the database using the topology_builder utility. The entropies assigned range from 0 to 1. A Vertex Entropy of 1 indicates a node of high topological importance.
  • The Cookbook Sigaliser now supports a new 'Seed Alert' filter configured as 'seed_alert' in $MOOGSOFT_HOME/config/moog_farmd.conf. This is an additional filter that determines whether to form a new Situation.

  • The number of hops that alert sources are apart can be used as an additional condition in value recipe grouping (hop_limit).

  • In this version, the Vertex Entropy value can be used in a Cookbook 'Value Recipe' as a 'trigger', 'exclusion' filter or 'seed alert' filter.

Log rotation is now automatically carried out by a new Java-based logging utility rather than the logrotate utility cron job. Logging changes include the following:

  • Moogfarmd and LAMs can use the option --logfilename to log into a custom log file. The full path and file name can be provided, otherwise the log file is named according to the HA address of the process (for example MOO.moog_farmd.farmd_instance1.log).
  • Moogfarmd and LAMs can use the option --logconsole to log on the console.
  • Both options can be used simultaneously if desired.

In the log file the line number is now directly concatenated to the class name. For example here is an old log entry:

INFO : [main   ][20180605 15:51:37.710 +0100] []:113 +|Reading moog_farmd config from: /export/src/incident/build/config/moog_farmd.conf|+

This is now logged as follows:

INFO : [main][20180605 15:51:37.710 +0100] [] +|Reading moog_farmd config from: /export/src/incident/build/config/moog_farmd.conf|+

The new log rotation behaviour is configured in $MOOGSOFT_HOME/config/system.conf. The file includes default behaviour of 500MB log file size limit and 40 maximum rotated files to store.


A non-root user can now control these processes using process_ctrl:

  • Apache_tomcat
  • Elasticsearch
  • Integration LAMs
  • Moogfarmd
  • MySQL
  • Nginx
  • Rabbitmq

For more information see Control Moogsoft AIOps Components as Non-root .


The logrotate utility is no longer used and is not installed as part of a new 6.5.0 deployment.


The new xMatters integration enables bidirectional communication between Moogsoft AIOps and xMatters. For more information see xMatters .


AWS Integration has been improved to retrieve Instance attributes.


The Email LAM now supports the removal of HTML tags from the email body.


The new AWS Simple Notification Service (SNS) integration allows a Lambda function to post data to Moogsoft AIOps when a CloudWatch alarm is triggered.


The new Dynatrace Notification integration a Dynatrace webhook to post data to Moogsoft AIOps when events occur. For more information see Dynatrace Notification .


The trapd_lam now supports SNMPv2 and SNMPv3 informs, as well as SNMPv3 traps. To enable SNMPv3 support the trapd_lam.conf must be included in trapd_usm.conf which contains the details of the configured users. See SNMPv3 for more information.


Bidirectional support has been added to the Cherwell integration. The status of Moogsoft AIOps Situations are kept in sync with corresponding Cherwell tickets. Journal notes added to Cherwell incidents are added to the comment thread of associated Situations in Moogsoft AIOps. For more information see Cherwell Workflow .


The new VMware vCenter integration enables Moogsoft AIOps to collect event data from vCenter. For more information see VMware vCenter .


The new Kafka integration allows non-event messages to be ingested and forwarded to Moobots via the IntegrationGateway topics. This allows the implementor to manipulate Situations and alerts using messages from Kafka.


In the JIRA Software and JIRA Service Desk integrations, JIRA tickets can now be assigned to the user who opened them from Moogsoft AIOps. This is configured in the 'Assign JIRA ticket to the creator' field.


In the Cherwell integration, Cherwell tickets can now be assigned to the user who opened them from Moogsoft AIOps. This is configured in the 'Assign Cherwell ticket to the creator' field.


In the Remedy integration, Remedy tickets can now be assigned to the user who opened them from Moogsoft AIOps. This is configured in the 'Assign tickets to the user that creates them' field.


The REST Client LAM now supports multiple targets. To enable this, add a field called 'targets' to rest_client_lam.conf containing the configuration of each target. A global 'request_interval' can also be defined at the monitor level. Targets will use this value if they do not have their own 'request_interval' value.

Multiple targets are defined in rest_client_lam.conf as follows:

monitor: {
  name: "REST Client Monitor",
  request_interval: 60,

  targets: {
    target1: {
      request_interval: 30,
      url: "localhost:8080/query",
    target2: {
      url: "localhost:8181/query",

In the ServiceNow integration, ServiceNow tickets can now be assigned to the user who opened them from Moogsoft AIOps. This is configured in the 'Assign ServiceNow ticket to the creator' field.


The new VMware vRealize Operations Manager (vROps) integration allows events to be sent from vROps to Moogsoft AIOps. For more information see VMware vROps .


The new Slack integration allows messages to be sent from Moogsoft AIOps to a specified Slack channel. For more information see Slack .


Integrations now rotate logs without the use of a cronjob.


Key Release Note

The Operator role now includes the alert_assign and moderator_assign permissions by default. These allow Operators to assign alerts and Situations to other users.


LDAP connection timeout and read timeout can now be configured. The settings are in $MOOGSOFT_HOME/config/security.conf:

# The timeout configures the connection and read timeout
# Defaults to 30000 milliseconds for both.
# "connectionTimeout": 30000,
# "readTimeout": 30000,

A number of small changes have been made to the UI, including reducing the color saturation for Situation severity 'lozenges' and removing horizonal line dividers in lists.


To reduce the chance of SAML login failures, the default value of the maximumAuthenticationLifetime property (in both the code and $MOOGSOFT_HOME/config/security.conf), has been increased from one hour to 720 hours


There is a new configuration option to extend connection and socket/request timeout for Elasticsearch. Settings are in the 'search' section of $MOOGSOFT_HOME/config/system.conf

# Configuration for elasticsearch connection timeouts,
# Timeouts are in milliseconds.
"connection_timeout"  : 1000,
"request_timeout" : 10000, 

The new aggregation option 'accumulate' has been added to getNewSituationsStats, getNewAlertsStats, getNewEventsStats and getAlertsInNewSituationsStats. When applied, the results are shown as accumulating from the first data point. For example, if there is one alert in the first hour, three alerts in the second hour and two alerts in the third hour the results with the accumulate aggregation will be 1, 4, 6. In Grafana, use the Accumulate integration to obtain the same results.


Button contrast in the UI has been improved for accessibility.


Team room chart accessibility has been improved.


The login page has been restyled.


The MySQL password can now be provided in the and scripts using the p or password flags. This does not apply to empty passwords.


The setCustomInfoValue method is now available to all events in bots and can be used in both moobots and lambots. It also creates the path necessary to set the value.


Moogfarmd displays the log path at startup and the version number is logged at the start of every log file.


LAMs now incorporate the same high availability functionality as moog_farmd. When system.conf is configured with automatic_failover set to true, if an active LAM appears to have gone down then a passive LAM for the same process group will become active and take its place.
If automatic_failover is set to true, the LAMs will need database access. If the configuration is set to false the LAMs can be run independently without connectivity to the database.
An active polling LAM will write information related to its last poll to the database during its HA heartbeat. This allows a passive polling LAM to take over from the last successful poll criteria from the active LAM.
Incoming LAMs such as rest_lam and kafka_lam do not have any state information and other strategies should be used to ensure event processing.
It is now important to correctly set the group name for each LAM in use. If there is more than one active leader in the same process group, only one will be active and the others will become passive.
Note: When stopping an active LAM and starting a previously passive LAM as active manually (i.e. not via any control utilities), the passive LAM will for wait the configured time to deem the previously active LAM unavailable, and the nominate itself as active.


The AWS CloudWatch integration now supports custom mapping in the LAMbot.


LAM configuration files no longer specify the cluster attribute for high availability. It is inherited from $MOOGSOFT_HOME/config/system.conf by default.


The long description and class fields in SCOM Alert are now limited to 3000 characters. The limit is configurable in the LAMbot.


The Situation client tool names of ticketing (ITSM) integrations (JIRA, JIRA Service Desk, Cherwell, ServiceNow) have been changed to "Open [ITSM] Ticket".


The Zabbix integration now remembers last poll information so that previously polled events are not picked up again. Clear events are now also being handled.


The JIRA Software, JIRA Service Desk, Cherwell and Remedy integrations now display the latest ticket opened from the Situation in the 'Ticket' Situation column. All ticket-related information is stored in an object called 'ticketing'.


ServiceNow tickets can now be created from alerts. These tickets have the following features:

  • There is no thread entry as alerts do not have a collaboration view
  • Only one ticket can be created for each alert
  • The description of the ServiceNow ticket includes a list of linked Situations

Remedy tickets can now be created from alerts. These tickets have the following features:

  • There is no thread entry as alerts do not have a collaboration view
  • Only one ticket can be created for each alert
  • The description of the Remedy ticket includes a list of linked Situations

JIRA Software and JIRA Service Desk tickets can now be created from alerts. These tickets have the following features:

  • There is no thread entry as alerts do not have a collaboration view
  • Only one ticket can be created for each alert
  • The description of the JIRA ticket includes a list of linked Situations

Cherwell tickets can now be created from alerts. These tickets have the following features:

  • There is no thread entry as alerts do not have a collaboration view
  • Only one ticket can be created for each alert
  • The description of the Cherwell ticket includes a list of linked Situations

Special characters including ampersands and quotation marks are now supported in input fields for ticketing integrations.


ServiceNow tickets are now created instantly by Moogsoft AIOps. There is no longer a need to open a new tab and save the ticket. This applies to opening tickets from both Situations and alerts.


The OEM integration now receives more fields from OEM and the event mapping has been improved.


In the Email integration there is a new drop-down list for protocol selection.


Functionality in the LamUtility and CommonUtils utilities has been consolidated into a single CommonUtils file.


The new Moobot utility ActionExecutor.js triggers functions from Moobots on receipt of Situation or alert actions.


The Apache Kafka integration has been updated to use the v. 1.1.0 client library. This resolves some compatibility issues with Apache Kafka v. 1.1.0.

Bug Fixes

Key Release Note

Users are no longer prompted to save probable root cause (PRC) data when no changes have been made.


Session IDs are now subject to length validation. If the ID exceeds 32 characters it is ignored and the session is considered invalid.


Tool tips on the summary screen are no longer partly obscured in certain places.


The 'show all' link on the merge panel now displays the correct colour on hover.


All links in comment replies now open in a new browser tab.


The same rounding calculation is now used in both mobile and desktop Services Overview.


All links in comments now open in a new browser tab.


LDAP users created without a timezone can now perform export operations.


Text in the popup dialog is no longer truncated when running a Situation Client Tool.


A bug that caused integers (for example 4, 13) to be sent as floating point (4.0, 13.0) in the REST moobot module (sendGet) has been resolved.


A condition that caused inconsistent transactional behaviour within a MySQL connection has been resolved.


The moveSituationToQueue MoogDb function no longer supports assigning closed Situations to a queue.


Hovering over the 'show more' link in the merge panel now displays the correct cursor.


Moogsoft AIOps no longer reports warnings about non-AIOps cookies in the apache-tomcat log.


Entries no longer disappear from the collaborate tab in the Situation Room after filtering options are changed.


The Maintenance Window Manager Moolet now checks recurring maintenance windows for expiry and updates them at startup.


When a custom Cookbook retention period is removed it now saves correctly.


In System Settings - Auto Close, the drop-down fields are now correctly displayed.


Situation Team assignment operations now use the MySQL retry mechanism defined in $MOOGSOFT_HOME/config/system.conf.


An exception is no longer generated when a Team Room is opened in a busy AIOps deployment. The max_prepared_stmt_count property in /etc/my.cnf has been increased to 1048576 to protect against this.


The moog_db_auto_upgrader utility now reports command output. Columns of type TIMESTAMP in the database have been updated to define their default values.


Hotkeys will only send a request to perform an action when the user has the required permissions.


A NullPointerException has been fixed in the Situation similarity functionality.


The Data Mapping fields list is now correctly displayed.


Event snapshots are now available in the UI after the database has been split.


Webhook based integrations now correctly ignore sub-paths. The integrations can now handle paths such as the following:

The Moobot REST module now handles UTF-8 two-byte characters correctly.


The Graze endpoint addService can no longer be used to update existing services.


The integration_installer utility now has additional logging to assist with troubleshooting a failed installation. If the utility cannot find the files it requires or if there is a problem connecting to the message bus it will be logged.


Values from custom fields are now shown in alert details in the UI.


The Situation similarity component no longer misses alert updates due to Auto Close and database split activity.


A null value in custom_info for an alert or Situation no longer crashes the UI.


New installations now employ two databases by default, an active database and a historic database. For more information see Historic Data Store .


The Situation similarity functionality no longer becomes unavailable in very active systems under certain conditions.


The Y axis of the MTTx portlet has been adjusted in the Ops Insights dashboard for greater clarity.


The Acknowledge option is now available in the Situation list context menu in the UI.


The Situation similarity functionality no longer causes an overload of the message bus listener and memory leak in very busy systems.


The moog_indexer now completes successfully in large deployments. The group_concat_max_len property in /etc/my.cnf has been increased to 1048576 to support this.


When installing Moogsoft AIOps as a non-root user, the ports used by Nginx are 8080 and 8443 instead of 80 and 443.


User updates via Graze and MoogDb no longer affect usernames.

MOOG-9243 Added text labels to buttons for accessibility.

The archiver no longer fails if Situation, alert and statistical data are being removed.


It is now possible to use a search query containing special characters such as a colon.


Graze requests now use the provided auth_token parameter even when a cookie is also provided.


The toolrunner can now be configured to execute locally by using the 'execute_locally' parameter in $MOOGSOFT_HOME/config/servlets.conf. If enabled the tools will run as the same user who ran the servlet container, and the sshtimeout, toolrunnerhost, toolrunneruser and toolrunnerpassword configuration options will be ignored. It can be used when performing an installation as a non-root user.


Functionality redesign has reduced the risk of unintended automatic failover in high availability environments when the environment is under heavy resource utilisation.


The help for the process_cntl utility now lists all controllable processes. For more information see Control Moogsoft AIOps Processes as Non-root .


White space characters are now displayed as expected in the details panel in the UI.


The flag to clean_reference_schema in has been changed from p to w.


The README file has been updated and now includes all prerequisites.


Nodes with upper case letters are now correctly calculated in graph topology.


The Moogfarmd --logfilename option now accepts a full path to a log file as well as just a file name. Entering a file name writes the log to the current working directory.


The actors table, which maintains the current processes running with high availability compatibility, now stores the identifier for each process as its full high availability address.


The process_cntl utility now supports starting more than one instance of Moogfarmd or a LAM. To start a second instance, use the --service_instance=<instance> flag. This looks for a configuration file named <process_name><instance>.conf and defaults the high availability group to <process_name><instance>.


Log file names are now separated by . instead of _ to be consistent with high availability naming.


The time tooltip is now correctly displayed for Situations in the search results view.


The moog_init scripts have been updated to cope with a remote MySQL instance where the 'validate_password' plugin is active, which requires complex passwords. This affects the 'ermintrude' user which is used by Moogsoft AIOps to interact with the database.

If or is provided with a remote database host via the -d parameter and a password using the -p parameter, $MOOGSOFT_HOME/config/system.conf is updated with the remote MySQL host/port information, and the remote MySQL instance is queried for the plugin active status. If the plugin is enabled, the ermintrude password is randomly generated and saved in $MOOGSOFT_HOME/config/servlets.conf during the moog_init script process.


SAML mappings no longer ignore special characters.


Situation activity entries no longer display multiple times under certain conditions.


Alert and Situation custom info fields with link definition now refer to the correct values.


If $MOOGSOFT_HOME is unset, scripts in /bin/utils take the value of the grandparent directory for Moogsoft home.


The Situation similarity component no longer causes a race condition at high event rate in certain conditions.


REST LAM-based integrations now include a "Content-Type": "application/json" response header.


The Email integration now has an option to parse the body message as a JSON object. This can be mapped to the default or custom alert fields. The JSON values can be referenced with '$body.keyA.innerKeyB'.


Bidirectional communication in the SCOM integration now works correctly.


Mapping in the Zenoss integration has been improved.


Source mapping in the SolarWinds integration has been improved.


Description mapping in the Dynatrace APM integration has been improved.


The EMC Smarts integration now works correctly.


The REST Client LAM parameter 'results_as_list' has been removed and the LAM now automatically determines how to handle the response.

The REST Client LAM parameter 'results_path' is now optional and is only applied if the response is a JSON object and not a list. Single event responses are now supported without being wrapped in a JSON object.


Improvements have been made to 'external_id' mapping in the VMware vCenter and vSphere integrations.


The SCOM Connector now uses a configurable date format when querying SCOM.


A warning related to cookies in IPv6 connectivity in the HP NNMi integration has been fixed.


The Email integration now supports IPv6 connections.


The RabbitMQ LAM can now consume events from other LAMs. This is useful when your architecture has data sources that are vastly geographically separated. A remote LAM can publish events to the remote RabbitMQ which is acting as a cache/buffer, ready to be consumed by the RabbitMQ LAM on the core Moogsoft AIOps server.


The REST Client LAM can now disable SSL certificate validation.

Deprecation Notices

Known Issues

Key Release Note

The ServiceNow integration link moog_link_to_situation contains an incorrect URL. See ServiceNow Integration Workaround .

PIR-1820 Improvements in the stability and reliability of the Indexer moolet have increased the time taken to index 100,000 Situations by approximately 8 seconds.

LDAP and SSO users do not inherit SMS settings by default. Manually edit your notification preferences as a workaround. De-select "Use System Defaults" and check the appropriate types of notifications to receive.

PIR-1884 Two automatically generated keystores for SAML are shipped in the 'Installer'/Non-root version of Moogsoft AIOps. Remove these files from $MOOGSOFT_HOME/etc/saml before using SAML.

The manifest file generated by the build process is incorrectly named. This can prevent Moogsoft AIOps Mobile UI users from adding a shortcut to the home screen.

MOOG-9690 Link Definitions do not render correctly when there are multiple entries.
INT-4184 A performance issue impacts the throughput of some LAMs. See REST-based LAMs direct HTTPS Workaround .

Release Date


For information on previous Enterprise Stability Releases see Moogsoft AIOps Releases .