Configure a Cookbook Manually

Cookbook is a deterministic clustering algorithm in Moogsoft AIOps that creates Situations defined by the relationships between alerts.

You can install a basic Cookbook via the UI by supplying a name, the Recipes you want it to use and configuring a few of the available properties. See Configure a Cookbook for setup steps.

Configure an advanced Cookbook if you want to configure additional properties such as determining if it runs on startup, selecting a different Moobot and other options available not available in the UI.

Before You Begin

Before you set up your Cookbook, ensure you have met the following requirements:

  • You have set up the recipes you want your Cookbook to use. See Configure a Cookbook Recipe for details.

  • Your LAMs or integrations are running and Moogsoft AIOps is receiving events.

  • You have configured the Moolet that you want Cookbook to process the output of.

Configure an Advanced Cookbook

Edit the configuration file at $MOOGSOFT_HOME/config/moolets/cookbook.conf to control the behavior of the Cookbook.

See the Cookbook and Recipe Reference for a full description of all properties. Some properties in the file are commented out by default. Uncomment the properties to enable them.

  1. Provide a name and description for the Cookbook:

    • name:Name of the Cookbook (required).

    • classname: Class of the Moolet. Do not change.

    • description:Text description of the Cookbook.

  2. Configure the Cookbook's behavior for when it starts and stops running:

    • run_on_startup: Determines whether Cookbook runs when Moogsoft AIOps starts.

    • metric_path_moolet: Determines whether or not Moogsoft AIOps includes Cookbook in the Event Processing metric for Self Monitoring.

    • moobot: Defines the Moobot that Cookbook loads at startup.

    • process_output_of: Defines the Moolet sources of the alerts that Cookbook processes.

  3. Configure the Cookbook algorithm and how it clusters alerts:

    • membership_limit:Maximum number of Situations that an alert can be a member of.

    • scale_by_severity: Enables Cookbook to ignore alerts with a severity of 0 (Clear).

    • entropy_threshold: Minimum entropy value an alert must have in order for Cookbook to include it in a Situation.

    • single_recipe_matching: Enables Cookbook to treat Recipes in priority order.

    • cluster_match_type: Defines the Cookbook cluster matching method.

    • cook_for: Minimum time period that Cookbook clusters alerts for before the recipe resets. The Recipe cook_for value overwrites this if it exists.

    • cook_for_extension: Time period that Cookbook can extend clustering alerts for before the Recipe resets and starts a new cluster. Setting this value enables the cook for auto-extension feature for this Cookbook.

    • max_cook_for: Maximum time period that Cookbook clusters alerts for before the Recipe resets and starts a new cluster. If cook_for_extension is set and this value is not set, it defaults to three times the cook_for value.

  4. Select and name the Recipe(s) you want Cookbook to use:

    • chef: Type of recipe you want to use. CValueRecipeV2, CValueRecipe or CBotRecipe.

    • name: Name of the Recipe.

    • description: Description of the Recipe.

  5. Configure the Recipe behavior and the filters that define the alert relationships. See Configure a Cookbook Recipe for more details.

    • recipe_alert_threshold: Maximum number of alerts to cluster before Cookbook creates a Situation.

    • exclusion: Filter determining the alerts to exclude from Situation creation.

    • trigger: Filter determining the alerts that Cookbook considers for Situation creation.

    • seed_alert: Filter determining whether to create a Situation from a seed alert.

    • rate: Filter determining the minimum event rate per minute required for Cookbook to create a Situation.

    • min_sample_size: Minimum number of events contained in a cluster before Moogsoft AIOps calculates the rate.

    • max_sample_size: Maximum number of events contained in a cluster before Moogsoft AIOps calculates the rate.

    • cook_for: Minimum time period that Cookbook clusters alerts for before the recipe resets. The Recipe cook_for value overwrites this if it exists.

    • cook_for_extension: Time period that Cookbook can extend clustering alerts for before the Recipe resets and starts a new cluster. Setting this value enables the cook for auto-extension feature for this Recipe.

    • max_cook_for: Maximum time period that Cookbook clusters alerts for before the Recipe resets and starts a new cluster.

  6. Configure the alert matching properties for the Recipe:

    • cluster_match_type: Defines how Cookbook matches alerts to clusters.

    • hop_limit: Maximum number of hops between the alert source nodes in order for the alerts to qualify for clustering.

    • components: Values that alerts must match for Cookbook to include them in a Situation.

Restart the Moogfarmd service to activate any changes you make to the configuration file. See Control Moogsoft AIOps Processes for further details.

Example

See Cookbook Examples for an example of Cookbook that uses a CValueRecipeV2.

Start or Stop the Cookbook

You can start or stop Cookbook if you want to make additional changes. You must always restart Moogfarmd for these changes to take effect.

Note that restarting Moogfarmd clears any existing clusters from Moogsoft AIOps.

See Control Moogsoft AIOps Processes for further details.

In this section: