Moogsoft Docs

Situation Merge Behavior

Moogsoft AIOps uses a configuration called the sig_similarity_limit to automatically merge similar Situations. When two Situations reach this similarity limit, AIOps merges them.

The default similarity limit for clustering algorithms is '0.7' so Situations sharing 70% of the same Alerts are merged.

Merge Groups

You can use merge_groups in moog_farmd.conf to control how AIOps merges Situations created by different clustering algorithms.

Any Sigaliser/moolet not defined in a new merge group belongs to the default group. By default, AIOps merges Situations when they meet the following criteria :

alert_threshold      : 2,
sig_similarity_limit : 0.7

To override the default behavior, you can create custom merge groups.

Create a Merge Group

You can create merge groups by following these steps:

  1. Edit moog_farmd.conf.
  2. Define new merge groups in the merge_groups section. For example:

    # {
    #        name: "Merge Group 1",
    #        moolets: ["Nexus", "Tempus"],
    #        alert_threshold      : 3,
    #        sig_similarity_limit : 0.75
    # }

    This merge group would only merge Situations created by the Nexus and Tempus Sigalisers which shared 75% of the same Alerts.

Each new merge group must be given a name and can be defined using the following values:

moolets

One or more Sigalisers/moolets which will be included in the merge group. Only Situations created by this Sigaliser or Sigalisers will be considered for merging with each other.

Type : String
Default : n/a

alert_threshold

The minimum number of Alerts that must be present in a cluster before it can become a Situation in the merge group.

Type : Integer

Default : 2

sig_similarity_limit

The measure of the similarity between two Situations before they are merged together. This value is the ratio of shared Alerts between two Situations to total unique Alerts in both Situations. For example, if two Situations share 50% of the same Alerts, the value would be 0.5.

Type : Integer
Default : 0.7

If you create a custom merge group for one or more Sigalisers, only Situations produced by the Sigalisers in the merge group will be considered for merging among themselves. Situations from Sigalisers outside of the defined merge group cannot be merged with any Situations in that group.

Field Behavior

When AIOps merges two or more Situations, it updates the fields of the situations as follows:

Field Old Situations New Situation
Category Superseded. Created.
Created At No change. Time of merge.
Description

No change.

Merge of Situations [X, Y, Z] where X, Y, and Z represent the Situation Ids of the superseded Situtations.
First Event Time No change. The First Event Time for the combined Situations.
ID No change. The next sequential Situation ID.
Last Change No change. The time that the merge took place.
Last Event Time No change. The value of the Situation in first position in the merge list.
Owned By No change. Default (none).

Participants

No change. Default (none).
Process Impacted No change. Combined values.
Queue No change. The queue of the Situation in first position in the merge list.
Rating No change. Default (none).
Scope No change. Combined values .
Scope Trend No change. Combined values .
Services Impacted No change. Combined values .
Sev Trend No change.
Combined values .
Severity No change. The highest severity of the merged Situations.
Status Dormant. Opened.
Story Adopts ID of new Situation. The Story ID is the same as the Situation ID of the new Situation.
Teams No change. All Teams monitoring the merged Situations.
Total Alerts No change. The sum of the Alerts of all merged Situations.
User Comments No change. Default (none).