moog_farmd

moog_farmd is a core system application that is responsible for running all the algorithmics and automation relevant to the Moogsoft product suite including:

The creation of alerts
The informatic analysis of those alerts to determine significance
The clustering of alerts into Situations
Any automation relating to the automated response (either), i.e., escalation, routing, notification, invitation of either alerts or Situations

You can run one or many moog_farmds on your system. (See moog_farmd.conf below.)

Command line attributes

The executable is a command line executable that can be run as a service daemon. The attributes can be viewed by typing:

% moog_farmd --help

Option	Description
--clear_state	Clears any persisted state information associated with this process group on startup
--cluster <arg>	Name of HA cluster (overwrites the value in the config file)
--group <arg>	Name of HA group (overwrites the value in the config file)
--leader <arg>	Is this instance an HA leader within its group (yes, no)
--mode <arg>	Start the process in passive or active mode (default will be active)
--config <arg>	Supplies a pathname to find the configuration file specific to the running instance
--instance <arg>	Enables you to give each instance of farmd a name, which you can use to refer to in farmd_ctrl. farmd_ctrl is a command line executable that allows you to bring up, restart and reload the various Moolets
--help	Displays all the command line options
--version	Displays the component’s version number
--loglevel <arg>	Specifies the level of debug. By default, you get everything. In common with all executables in MOOG, having it set at that level can result in a lot of output (many messages per event message processed). In all production implementations it is recommended that log level be set to WARN, which only informs you of matters of importance

By default you do not need either 'config' or 'instance'. If you run the system without configuring either, the moog_farmd instance will load the default configuration file for moog_farmd, and respond to farmd_ctrl with no instance specified.

See High Availability for HA specific command line options.

Services

We advise that you start moog_farmd as a service. A service script is provided out of the box for the default moog_farmd configuration and is located here:

/etc/init.d/moogfarmd

A backup moogfarmd service script is located:

$MOOGSOFT_HOME/etc/service-wrappers/moogfarmd

If using multiple moog_farmds on the same host we advise you copy and modify the default moogfarmd service script for each moog_farmd running on the host.

Copy $MOOGSOFT_HOME/etc/service-wrappers/moogfarmd to /etc/init.d/mymoogfarmd

Edit the following parameters in the /etc/init.d/mymoogfarmd file:

SERVICE_NAME=mymoogfarmd
CONFIG_FILE=$PROCESS_HOME/config/my_moog_farmd.conf

You now have a new service to be used to start your own specific moog_farmd.

service mymoogfarmd start

Configuration

system.conf

The general Moogsoft system configuration file is located in $MOOGSOFT_HOME/config/system.conf.

This file specifies how all components communicate with external systems such as MySQL and Elasticsearch. By editing the settings in this file, these systems can run on a separate host to that which runs the Moogsoft software. The system is shipped with a default configuration, which assumes that MySQL and Elasticsearch are all running on the same host as Moogsoft AIOps.

The format of the file is a JSON object, specifying the network locations of the various components:

...
    "mysql" : 
        { 
           "host" : "localhost", 
           "database" : "moogdb", 
           "username" : "ermintrude", 
           "password" : "m00", 
           "port" : 3306 
         }, 

     "search" :
        {   
            "limit"         : 1000,
            "nodes" : [ 
                {   
                    "host"     : "localhost",
                    "port"     : 9200
                }   
            ]   
        }
...

moog_farmd.conf

If you are using many moog_farmds they each need their own config file. All instances of moog_farmd which do not specify a different --config use the default configuration file located in $MOOGSOFT_HOME/config/moog_farmd.conf.

Moolets

moog_farmd runs Moolets which are individual isolated applications running inside a farmd app container. Moolets are a parallel concept to servlets in a traditional enterprise application container such as Tomcat. moog_farmd controls the flow of data through the Moolets where the data can come via the message bus or from other Moolets.

In the general configuration for moog_farmd there are certain parameters you need to configure, namely the number of threads available to each Moolet, followed by the list of each Moolet's specific configuration.

Configuring threads

The threads configuration element relates to the number of threads available to each Moolet. When you define a Moolet, if the system wide setting for threads is 10 (the default), farmd will run 10 instances of the Moolet so you can achieve high parallelism in the system. When you have an extremely high load, for example very high event rates (> 100 events per second), then you are advised to increase the number of threads. It may also be worth overriding the default value in specific Moolet configurations to achieve different levels of parallelism. E.g. You may give the Alert Builder Moolet more threads compared to the Sigaliser Moolet because you expect high levels of deduplication in the Alert Builder.

Page tree

Event Processing