Moogsoft Docs

Situation Merge Behavior

Moogsoft AIOps uses a configuration called the sig_similarity_limit to automatically merge similar Situations. When two Situations reach this similarity limit, Moogsoft AIOps merges them.

The default similarity limit for clustering algorithms is '0.7' so Situations sharing 70% of the same alerts are merged.

Merge Groups

You can use merge_groups in moog_farmd.conf to control how Moogsoft AIOps merges Situations created by different clustering algorithms.

Any Sigaliser/moolet not defined in a new merge group belongs to the default group. By default, Moogsoft AIOps merges Situations when they meet the following criteria:

alert_threshold      : 2,
sig_similarity_limit : 0.7

To override the default behavior, you can create custom merge groups.

Create a Merge Group

You can create merge groups by following these steps:

  1. Edit moog_farmd.conf.

  2. Define new merge groups in the merge_groups section. For example:

    # {
    #        name: "Merge Group 1",
    #        moolets: ["Cookbook", "Tempus"],
    #        alert_threshold      : 3,
    #        sig_similarity_limit : 0.75
    # }

    This merge group would only merge Situations created by the Cookbook and Tempus Sigalisers which shared 75% of the same alerts.

Each new merge group must be given a name and can be defined using the following values:

moolets

One or more Sigalisers/moolets which will be included in the merge group. Only Situations created by this Sigaliser or Sigalisers will be considered for merging with each other.

Type: String

Default: n/a

alert_threshold

The minimum number of alerts that must be present in a cluster before it can become a Situation in the merge group.

Type: Integer

Default: 2

sig_similarity_limit

The measure of the similarity between two Situations before they are merged together. This value is the ratio of shared alerts between two Situations to total unique alerts in both Situations. For example, if two Situations share 50% of the same alerts, the value would be 0.5.

Type: Integer

Default: 0.7

If you create a custom merge group for one or more Sigalisers, only Situations produced by the Sigalisers in the merge group will be considered for merging among themselves. Situations from Sigalisers outside of the defined merge group cannot be merged with any Situations in that group.

Field Behavior

When Moogsoft AIOps merges two or more Situations, it updates the fields of the Situations as follows:

Field

Old Situations

New Situation

Category

Superseded.

Created.

Created At

No change.

Time of merge.

Description

No change.

Merge of Situations [X, Y, Z] where X, Y, and Z represent the Situation IDs of the superseded Situations.

First Event Time

No change.

The First Event Time for the combined Situations.

ID

No change.

The next sequential Situation ID.

Last Change

No change.

The time that the merge took place.

Last Event Time

No change.

The value of the Situation in first position in the merge list.

Owned By

No change.

Default (none).

Participants

No change.

Default (none).

Process Impacted

No change.

Combined values.

Queue

No change.

The queue of the Situation in first position in the merge list.

Rating

No change.

Default (none).

Scope

No change.

Combined values.

Scope Trend

No change.

Combined values.

Services Impacted

No change.

Combined values.

Sev Trend

No change.

Combined values.

Severity

No change.

The highest severity of the merged Situations.

Status

Dormant.

Opened.

Story

Adopts ID of new Situation.

The Story ID is the same as the Situation ID of the new Situation.

Teams

No change.

All Teams monitoring the merged Situations.

Total Alerts

No change.

The sum of the Alerts of all merged Situations.

User Comments

No change.

Default (none).