moog_farmd is a core system application that is responsible for running all the algorithmics and automation relevant to the Moogsoft product suite including:
- The creation of Alerts
The informatic analysis of those Alerts to determine significance
The clustering of Alerts into Situations
Any automation relating to the automated response (either), i.e., escalation, routing, notification, invitation of either Alerts or Situations
You can run one or many moog_farmds on your system. (See moog_farmd.conf below.)
Command line attributes
The executable is a command line executable that can be run as a service daemon, and takes five attributes, which can be viewed by typing:
% moog_farmd --help
|Clears any persisted state information associated with this process group on startup|
Name of HA cluster (overwrites the value in the config file)
Name of HA group (overwrites the value in the config file)
|Is this instance an HA leader within its group (yes, no)|
|Start the process in passive or active mode (default will be active)|
Supplies a pathname to find the configuration file specific to the running instance
Enables you to give each instance of farmd a name, which you can use to refer to in farmd_ctrl. farmd_ctrl is a command line executable that allows you to bring up, restart and reload the various Moolets
Displays all the command line options
Displays the component’s version number
Specifies the level of debug. By default, you get everything. In common with all executables in MOOG, having it set at that level can result in a lot of output (many messages per event message processed). In all production implementations it is recommended that log level be set to WARN, which only informs you of matters of importance
By default you do not need either 'config' or 'instance'. If you run the system without configuring either, the moog_farmd instance will load the default configuration file for moog_farmd, and respond to farmd_ctrl with no instance specified.
See High Availability for HA specific command line options.
We advise that you start moog_farmd as a service. A service script is provided out of the box for the default moog_farmd configuration and is located here:
A backup moogfarmd service script is located:
If using multiple moog_farmds on the same host we advise you copy and modify the default moogfarmd service script for each moog_farmd running on the host.
- Copy $MOOGSOFT_HOME/etc/service-wrappers/moogfarmd to /etc/init.d/mymoogfarmd
Edit the following parameters in the /etc/init.d/mymoogfarmd file:
You now have a new service to be used to start your own specific moog_farmd.
The general Moogsoft system configuration file located in $MOOGSOFT_HOME/config/system.conf.
This file specifies how all components communicate with external systems such as MySQL and Elasticsearch. By editing the settings in this file, these systems can run on a separate host to that which runs the Moogsoft software. The system is shipped with a default configuration, which assumes that MySQL and Elasticsearch are all running on the same host as Moogsoft AIOps.
The format of the file is a JSON object, specifying the network locations of the various components:
If you are using many moog_farmds they each need their own config file. All instances of moog_farmd which do not specify a different --config use the default configuration file located in $MOOGSOFT_HOME/config/moog_farmd.conf.
moog_farmd runs Moolets which are individual isolated applications running inside a farmd app container. Moolets are a parallel concept to servlets in a traditional enterprise application container such as Tomcat. moog_farmd controls the flow of data through the Moolets where the data can come via the message bus or from other Moolets.
In the general configuration for moog_farmd there are certain parameters you need to configure, namely the number of threads available to each Moolet, followed by the list of each Moolet's specific configuration.
The threads configuration element relates to the number of threads available to each Moolet. When you define a Moolet, if the system wide setting for threads is 10 (the default), farmd will run 10 instances of the Moolet so you can achieve high parallelism in the system. When you have an extremely high load, for example very high event rates (> 100 events per second), then you are advised to increase the number of threads. It may also be worth overriding the default value in specific Moolet configurations to achieve different levels of parallelism. E.g. You may give the Alert Builder Moolet more threads compared to the Sigaliser Moolet because you expect high levels of deduplication in the Alert Builder.