Configure and Retrain Probable Root Cause
Probable root cause (PRC) for Moogsoft Enterprise is enabled by default. This means that you can mark Situation alerts as having a root cause or not and Moogsoft Enterprise shows a root cause estimate in Next Steps in the Situation Room.
Navigate to Settings > Probable Root Cause to enable or disable PRC.
To configure which users can mark alerts for PRC, go to Security > Roles. Select the role you want to edit and under Permissions, move 'prc_feedback' to 'Selected' using the direction arrows. This permission is enabled for Administrator and Super User roles by default.
Root Cause
The PRC Model gives each alert within a Situation a probable root cause estimate. Retrain recalculates the estimates with the current data. You can choose which features your model uses when predicting the probable root cause of an alert. The default PRC configuration uses two types of Severity. The other features are listed below:
Feature | Description |
Agent | The agent of the alert represented as an enumeration. Each value of 'agent' is considered to be independent from all other values. |
Alert Arrival Order | Represents the arrival order of the alert in a Situation. |
Alert Time | Represents the alert time as the components of the 'time of day', for example, hours of day, minutes of hour. |
Class | The class of the alert, represented in a way that identifies naming conventions in the class name. |
Description | Tokenizes the description into words and uses those words to identify key words and phrases that may indicate root cause. |
Host | The host of the alert, represented in a way that identifies naming conventions in the class name. |
Manager | The manager of the alert represented as an enumeration. Each value of 'manager' is considered to be independent from all other values. |
Severity & Arrival Order (default ) | The severity of the alert represented as independent values and when the alert arrived for each value of severity. For best results use in conjunction with 'Severity Raw'. |
Severity Enum | The severity of the alert represented as independent values. For best results use in conjunction with 'Severity Raw'. |
Severity Raw (default) | The severity of the alert represented as a continuous value such that 'Warning' < 'Major' < 'Critical'. For best results use in conjunction with 'Severity Enum' or 'Severity & Arrival Order'. |
Situation Alert Time | Represents the alert time as the components of time, for example, hours of day, minutes of hour, relative to the first alert in the Situation. |
Type | The type of the alert, represented in a way that identifies naming conventions. |