moog_farmd
moog_farmd is a core system application that is responsible for running all the algorithmics and automation relevant to the Moogsoft product suite including:
- The creation of alerts
The informatic analysis of those alerts to determine significance
The clustering of alerts into Situations
Any automation relating to the automated response (either), i.e., escalation, routing, notification, invitation of either alerts or Situations
You can run one or many moog_farmds on your system. (See moog_farmd.conf below.)
Command line attributes
The executable is a command line executable that can be run as a service daemon. The attributes can be viewed by typing:
% moog_farmd --help
Option | Description |
---|---|
--clear_state | Clears any persisted state information associated with this process group on startup |
--cluster <arg> | Name of HA cluster (overwrites the value in the config file) |
--group <arg> | Name of HA group (overwrites the value in the config file) |
--leader <arg> | Is this instance an HA leader within its group (yes, no) |
--mode <arg> | Start the process in passive or active mode (default will be active) |
--config <arg> | Supplies a pathname to find the configuration file specific to the running instance |
--instance <arg> | Enables you to give each instance of farmd a name, which you can use to refer to in farmd_ctrl. farmd_ctrl is a command line executable that allows you to bring up, restart and reload the various Moolets |
--help | Displays all the command line options |
--version | Displays the component’s version number |
--loglevel <arg> | Specifies the level of debug. By default, you get everything. In common with all executables in MOOG, having it set at that level can result in a lot of output (many messages per event message processed). In all production implementations it is recommended that log level be set to WARN, which only informs you of matters of importance |
By default you do not need either 'config' or 'instance'. If you run the system without configuring either, the moog_farmd instance will load the default configuration file for moog_farmd, and respond to farmd_ctrl with no instance specified.
See High Availability for HA specific command line options.
Services
We advise that you start moog_farmd as a service. A service script is provided out of the box for the default moog_farmd configuration and is located here:
/etc/init.d/moogfarmd
A backup moogfarmd service script is located:
$MOOGSOFT_HOME/etc/service-wrappers/moogfarmd
If using multiple moog_farmds on the same host we advise you copy and modify the default moogfarmd service script for each moog_farmd running on the host.
- Copy $MOOGSOFT_HOME/etc/service-wrappers/moogfarmd to /etc/init.d/mymoogfarmd
Edit the following parameters in the /etc/init.d/mymoogfarmd file:
SERVICE_NAME=mymoogfarmd CONFIG_FILE=$PROCESS_HOME/config/my_moog_farmd.conf
You now have a new service to be used to start your own specific moog_farmd.
service mymoogfarmd start
Configuration
system.conf
The general Moogsoft system configuration file is located in $MOOGSOFT_HOME/config/system.conf.
This file specifies how all components communicate with external systems such as MySQL and Elasticsearch. By editing the settings in this file, these systems can run on a separate host to that which runs the Moogsoft software. The system is shipped with a default configuration, which assumes that MySQL and Elasticsearch are all running on the same host as Moogsoft AIOps.
The format of the file is a JSON object, specifying the network locations of the various components:
... "mysql" : { "host" : "localhost", "database" : "moogdb", "username" : "ermintrude", "password" : "m00", "port" : 3306 }, "search" : { "limit" : 1000, "nodes" : [ { "host" : "localhost", "port" : 9200 } ] } ...
moog_farmd.conf
If you are using many moog_farmds they each need their own config file. All instances of moog_farmd which do not specify a different --config use the default configuration file located in $MOOGSOFT_HOME/config/moog_farmd.conf.
Moolets
moog_farmd runs Moolets which are individual isolated applications running inside a farmd app container. Moolets are a parallel concept to servlets in a traditional enterprise application container such as Tomcat. moog_farmd controls the flow of data through the Moolets where the data can come via the message bus or from other Moolets.
In the general configuration for moog_farmd there are certain parameters you need to configure, namely the number of threads available to each Moolet, followed by the list of each Moolet's specific configuration.
Configuring threads
The threads configuration element relates to the number of threads available to each Moolet. When you define a Moolet, if the system wide setting for threads is 10 (the default), farmd will run 10 instances of the Moolet so you can achieve high parallelism in the system. When you have an extremely high load, for example very high event rates (> 100 events per second), then you are advised to increase the number of threads. It may also be worth overriding the default value in specific Moolet configurations to achieve different levels of parallelism. E.g. You may give the Alert Builder Moolet more threads compared to the Sigaliser Moolet because you expect high levels of deduplication in the Alert Builder.