Page tree
Skip to end of metadata
Go to start of metadata

Cookbook is a deterministic clustering algorithm in Moogsoft AIOps that creates Situations defined by the relationships between alerts.

You can install a basic Cookbook via the UI by supplying a name, the recipes you want it to use and configuring a few of the available properties. See Configure a Cookbook for setup steps.

Configure an advanced Cookbook if you want to configure additional properties such as determining if it runs on startup, selecting a different Moobot and other options available not available in the UI.

Before You Begin

Before you set up your Cookbook, ensure you have met the following requirements:

  • You have set up the recipes you want your Cookbook to use. See Configure a Cookbook Recipe for details.
  • Your LAMs or integrations are running and Moogsoft AIOps is receiving events.
  • You have configured the Moolet that you want Cookbook to process the output of

Configure an Advanced Cookbook

Edit the configuration file at $MOOGSOFT_HOME/config/moolets/cookbook.conf to control the behavior of the Cookbook.

See the Cookbook and Recipe Reference for a full description of all properties. Some properties in the file are commented out by default. Uncomment the properties to enable them.

  1. Provide a name and description for the Cookbook:

    • name: Name of the Cookbook (required).
    • classname: Class of the Moolet. Do not change.
    • description: Text description of the Cookbook.

  2. Configure the Cookbook's behavior for when it starts and stops running:

    • run_on_startup: Determines whether Cookbook runs when Moogsoft AIOps starts.
    • metric_path_moolet: Determines whether Moogsoft AIOps includes Cookbook in the Moogfarmd calculation for self monitoring. See Monitor and Troubleshoot Moogsoft AIOps for more information.
    • moobot: Defines the Moobot that Cookbook loads at startup.
    • process_output_of: Defines the Moolet sources of the alerts that Cookbook processes.

  3. Configure the Cookbook algorithm and how it clusters alerts:

    • membership_limit: Maximum number of Situations that an alert can be a member of.
    • scale_by_severity: Cookbook treat alerts with a high severity like alerts with a high entropy value. 
    • entropy_threshold: Minimum entropy value an alert must have in order for Cookbook to include it in a Situation.
    • single_recipe_matching: Enables Cookbook to treat Recipes in priority order.
    • cluster_match_typeDefines the Cookbook cluster matching method.
    • cook_for: Minimum time period that Cookbook clusters alerts for before the Recipe resets.
    • cook_for_extension: Time period that Cookbook can extend clustering alerts for before the Recipe resets and starts a new cluster. Setting this value enables the cook for auto-extension feature for this Cookbook.
    • max_cook_for: Maximum time period that Cookbook clusters alerts for before the Recipe resets and starts a new cluster.

  4. Select and name the Recipe(s) you want Cookbook to use:

    • chef: Type of recipe you want to use. CValueRecipeV2, CValueRecipe or CBotRecipe.
    • name: Name of the Recipe.
    • description: Description of the Recipe.

  5. Configure the Recipe behavior and the filters that define the alert relationships. See Configure a Cookbook Recipe for more details.

    • recipe_alert_threshold: Maximum number of alerts to cluster before Cookbook creates a Situation.
    • exclusion: Filter determining the alerts to exclude from Situation creation.
    • trigger: Filter determining the alerts that Cookbook considers for Situation creation.
    • seed_alert: Filter determining whether to create a Situation from a seed alert.
    • rate: Filter determining the minimum event rate per minute required for Cookbook to create a Situation.
    • min_sample_size: Minimum number of events contained in a cluster before Moogsoft AIOps calculates the rate.
    • max_sample_size: Maximum number of events contained in a cluster before Moogsoft AIOps calculates the rate.
    • cook_for: Minimum time period that Cookbook clusters alerts for before the recipe resets. The Cookbook cook_for value overwrites this if it exists.
    • cook_for_extension: Time period that Cookbook can extend clustering alerts for before the Recipe resets and starts a new cluster. Setting this value enables the cook for auto-extension feature for this Recipe.
    • max_cook_forMaximum time period that Cookbook clusters alerts for before the Recipe resets and starts a new cluster.

  6. Configure the alert matching properties for the Recipe:

    • cluster_match_type: Defines how Cookbook matches alerts to clusters. 
    • hop_limit: Maximum number of hops between the alert source nodes in order for the alerts to qualify for clustering.
    • components: Values that alerts must match for Cookbook to include them in a Situation. 

Restart the Moogfarmd service to activate any changes you make to the configuration file. See Control Moogsoft AIOps Processes for further details.

Example 

The following example demonstrates a Cookbook that uses a CValueRecipeV2 that splits alerts into clusters with either a  source_id  (hostname) or a  description that are 50% similar. You control this under the components property:

matcher:{  
	components:[  
	{  
		name:"source_id",
		similarity:0.5,
	},
	{  
		name:"description",
		similarity:0.5,
	}
}

It also only creates a Situation from a seed alert with a Vertex Entropy value of 0.75 which indicates a node of high topological importance. You control the seed alert filter with this property:

 seed_alert:"vertex_entropy = 0.75",

The full example Cookbook with both configurations is as follows:

{  
   name:"Cookbook",
   classname:"CCookbook",
   run_on_startup:true,
   persist_state:false,
   metric_path_moolet:true,
   moobot:"Cookbook.js",
   process_output_of:"MaintenanceWindowManager",
   membership_limit:1,
   scale_by_severity:false,
   entropy_threshold:0.0,
   single_recipe_matching:false,
   cluster_match_type:"first_match",
   recipes:[  
      {  
         chef:"CValueRecipeV2",
         name:"SplitBySourceAndDescription",
         description:"Value Recipe outage",
         recipe_alert_threshold:0,
         exclusion:"severity < 5",
         trigger:null,
         seed_alert:"vertex_entropy = 0.75",
         rate:0,
         min_sample_size:5,
         max_sample_size:10,
         #cook_for:5000,
         cluster_match_type:"first_match",
         matcher:{  
            hop_limit:2,
            components:[  
               {  
                  name:"source_id",
                  similarity:0.5,
                  shingle_size:4
               },
               {  
                  name:"description",
                  similarity:0.5,
                  shingle_size:-1
               }
            ]
         }
       }
      ],
      cook_for:2000
   }

Start or Stop the Cookbook

You can start or stop Cookbook if you want to make additional changes. You must always restart Moogfarmd for these changes to take effect.

Note that restarting Moogfarmd clears any existing clusters from Moogsoft AIOps.

See Control Moogsoft AIOps Processes for further details.

  • No labels