AIOps

 View Only
  • 1.  Event Manager - Event Analytics - More material/details

    Posted Fri November 12, 2021 07:37 AM
    Hello,

    Does anyone know how/where we can find more technical material about the "Event Analytics" part?

    Here are some of the points we are looking for:
    • More details on the Architecture. Ex.:
      • Flow of data within the sub-components
      • What each sub-component is doing/processing and when
    • How to clear the training model? To be able to start from scratch
    • Specific question about the training:
      • We have a 1-month of events data (json format) extracted from a customer (traditional Netcool installation)
      • We have setup a way to inject these events into the Event Manager. And when we run it, the events are inserted respecting the LastOccurrence in which they occurred at first place. Resolutions also work fine
      • Question here: Can we simply inject all of these events into the ObjectServer sequentially as a batch (ex.: 1-month events data might take a few hours to complete)? Or do we need to respect the time interval between the events being injected (meaning, we would take 1-month to inject a 1-month of data collected)?

    We have already checked the following resources, but there is no (or not enough) information:
    • IBM Documentation Page (previously known as "Knowledge Center"): IBM Docs
    • seismic
    • This forum

    Thanks in advance.
    Kind regards,
    Rafael

    ------------------------------
    Rafael Valenca
    serima Consulting AG
    Hünenberg
    ------------------------------


  • 2.  RE: Event Manager - Event Analytics - More material/details

    Posted Fri November 12, 2021 07:57 AM
    Hi Rafael,

    While I don't have the specific answers you're looking for, I do know that the entire Event Analytics implementation consists of Impact policies and data stored in the Impact Derby database (and/or in DB2, depending on configuration). So you actually have direct access to read the source code of the entire implementation. 

    Frank

    Frank Tate
    MBA, PMP, CISSP
    CEO, Gulfsoft Consulting
    ph: 304-376-6183





  • 3.  RE: Event Manager - Event Analytics - More material/details

    Posted Fri November 12, 2021 08:27 AM
    Hello Frank,

    Thanks for the quick reply.

    I am actually talking about the "Cloud Native Analytics":

    https://www.ibm.com/docs/en/noi/1.6.3?topic=systems-trying-out-cloud-native-analytics

    The one you are saying is probably this:

    https://www.ibm.com/docs/en/noi/1.6.3?topic=management-configuring-event-analytics

    Sorry for the misunderstanding. Since both are related to events, I have kind of mixed a little the terms there.

    Kind regards,
    Rafael

    ------------------------------
    Rafael Valenca
    serima Consulting AG
    Hünenberg
    ------------------------------



  • 4.  RE: Event Manager - Event Analytics - More material/details

    Posted Fri November 12, 2021 10:14 AM
    Edited by john postoyko Fri November 12, 2021 05:49 PM

    H Rafael

    Can you please tell me which version of NOI you are running ?

    Also I would not use LastOccurrence - rather use FirstOccurrence because First gives a view of the grouping more closely timed to the actual real world event,  LastOccurrence can give vastly differing views of the event grouping

    Architecture : what each part does has a degree of secret sauce

    We have tools for extracting data from historical archives and pushing it in bulk into CNEA for training  ( this removes the need to push the events into the ObjectServer which can be challenging)

    cat ./events.json.gz | kubectl run ingesthttp43 -i --restart=Never --image=cp.icr.io/cp/noi/ea-events-tooling:4.1.1-20200911144353BST --env=INPUT_FILE_NAME=stdin --env=LICENSE=accept --env=HTTP_USERNAME=system --env=HTTP_PASSWORD=<system password> filetoingestionservice.sh jdp-noi -n noi --serviceaccount='noi-service-account'

    image name depends on the version of NOI you have installed - and use your value for jdp-noi

    If your data is more than 90 days back in time - you will need to alter the start and end times of training  - let me know if this is the case and I can walk you through that process

    To clear out any events that have already gone in

    log into your cassandra pod then into cassandra 

    cqlsh -u hdm -p <CassandraPassword>

    truncate ea_events.events;

    truncate ea_events.event_instances

    all the best

    John



    ------------------------------
    john postoyko
    IBM
    London
    ------------------------------