Configuring Alarm Correlation Rule Settings

An Alarm Correlation Rule is configured to filter the raw alarms and prioritize the alarm that requires action. It helps define and specify which alarm should be considered and addressed. When the alarm rule matches the raw alarm, a filtered alarm is created. The specifications of a correlation rule varies based on the alarm approach for which it is being created.

The upcoming sections illustrate how to configure rule details, controller criteria and site criteria, while creating an alarm correlation rule.

Defining Rule Details

The elementary requirement of creating a filter correlation rule is to define the rule type and an alarm approach. In addition, this section allows you to register the details, like its name, description, client, alarm type, and so on.

To configure rule details,

Navigate to the Rule Details section from the New Alarm Correlation Rule screen. The following screen appears as shown below.
Update the following fields in this section:
- Name - A label to identify the rule
- Description - Ashort note describing the purpose of the rule
- Client - The entity for which the rule details are being created
  Note: Once the client field is saved, it becomes non-editable.
- Rule Type - The rule type is a categorization of specific criteria that are defined to trigger certain actions. For each rule type, the set of criteria configuration fields differ. The following are the rule types:
  Filter
  The incoming raw alarms that meet the specified criteria will be directly filtered as individual alarms. In order to define a filter rule, you must update the below criteria type:
  Alarm active for a defined period - The alarm condition that persists or remains active for a specific duration. You can mention the duration in the respective field
  Alarms during a specific time frame - The number of alarms generated within a specified time interval. You can mention the number of alarm count and duration in the respective fields
  Alarm active for a defined period or Alarms during a specific time frame - Alarms that are either active for a specified time period or the number of alarms triggered within the defined period. You can update the alarm duration, number of alarm count and duration in the respective fields
  Do not process - To suspend the automated processing of alarms
  Connection Loss
  In this rule type, the system is configured to expect regular signals within a defined time interval. These signals serve as a confirmation that the monitored system is operational and communicating. Any deviation from the expected ping triggers a filtered alarm. Hence, when the ping alarm is not received, the message associated in the rule configuration is displayed, indicating the details of the problem. In order to define a criteria you must update the following fields:
  Alarm duration : The time duration for which the specified conditions must persist to trigger the filtered alarm
  Alarm message : The system will produce a message indicating that the controller went offline and hence the connection is lost
  Note: For this rule type, the Alarm Type field is set to Ping by default.
  Note: The filtered alarm gets automatically cleared when the connection is restored.
  Roll Up
  Roll-up alarms are designed to address scenarios where a specified count of child alarms triggers an alarm for the corresponding parent asset. For example, if there are five child assets and an alarm is configured to trigger when at least three child assets have issues, an alarm is created for the parent asset. In order to define a criteria you must update the following fields:
  Asset Category - The category to which an asset belongs to. For example, AHU
  Asset Relation - The relation of an asset with the related entities
  Duration - The time duration for which the specified conditions must persist to trigger the correlation rule
  Weightage - The numeric value to specify the number of assets
  Note: This field appears based on the entity selected in the Asset Relation field.
  Message - The text associated with an alarm that the correlation rule will use to identify and correlate related alarms
  Site Offline
  This rule type indicates an offline or disconnected status for a site. The site is offline when the configured number of controllers are offline for a specific time. The site becomes operational only when the configured number of controllers returns to the working state. For example, if the configured criteria specify two controllers, both must return to their normal state. Even if one controller is offline, the site still remains in an offline status. In order to define this criteria you must update the following fields:
  Duration - The time duration for which the specified conditions must persist to trigger the correlation rule
  Weightage - The numeric value to specify the number of controllers that are offline. It can be mentioned in counts or in percentage based on the selected option.
  Message - The text associated with an alarm that the correlation rule will use to identify and correlate related alarm
  Note: For this rule type, the Alarm Type field is set to Controller Offline by default.
  Note: The fields mentioned in the types of rules differ based on the selected alarm approach.
- Alarm Type - The classification of alarms with unique set of attributes
- Alarm Approach - The strategy to handle the alarms. The following are the types of alarm to be approached:
  - Return to Normal (RTN) - In this strategy, alarms provide a clear and explicit indication of both the occurrence and resolution of abnormal conditions. When an abnormal condition occurs, the system generates an "alarm occur" signal indicating the deviation from normal. When the system returns to its normal state, a corresponding "alarm clear" signal is sent, signifying the resolution of the issue.
  - Repeat until Resolved (RUR) - In this strategy, alarms do not have a designated "clear" signal sent explicitly. Instead, a mechanism is established to determine the resolution of the alarm. This is achieved through a definable alarm clear period. If, within this specified period, no further alarms are received, the system infers that the issue has been resolved, and the alarm is considered cleared.
Click Save & Close. The rule details are configured successfully.

Defining Controller Criteria

Defining controller criteria is a crucial aspect of the condition creation process. In general, a condition represents a set or combination of criteria that filters alarms based on specific conditions tailored to a particular controller.

To define a controller criteria,

Navigate to the Controller Criteria section from the New Alarm Filter Correlation screen. The following screen appears as shown below.
Update the following fields in this screen to define a controller criteria.
- Select Attribute - Select an attribute on which the condition is to be applied.
- Operator - Select the operation or comparison methodology to be applied. You can choose any of the following possible operators:
  - Is empty
  - Is not empty
  - Is
  - Isn't
  - With role
  - Date related operators (like, yesterday, starting tomorrow, last month, this week and so on)
  - Numeric operators (like, !=, >=, >, between and so on)
  - String operators (like, contains, doesn't contains, starts with, ends with, my teams, and so on)
  Note: The operators displayed vary with respect to the attribute chosen.
- Value - Enter a value for which the condition applies.
  Note: The applicability of this field depends on the operator set. For example, if the operator is set to 'Is empty' this field is not applicable.
A sample criterion configuration is shown in the screenshot below.
You can use the +Add Condition button to add a record and the (delete) icon to remove a record in this window.
Click Save & Close.The controller criteria are configured successfully.

Defining Site Criteria

Defining site criteria is an essential aspect of the condition creation process. The condition represents a single criterion or a combination of criteria that filters alarms based on the conditions tailored to a specific site.

To define site criteria,

Navigate to the Site Criteria section from the New Alarm Correlation Rule screen. The following screen appears as shown below.
Update the following fields in this screen to define a site criteria.
- Select Attribute - Select an attribute on which the condition is to be applied.
- Operator - Select the operation or comparison methodology to be applied. You can choose any of the following possible operators:
  - Is empty
  - Is not empty
  - Is
  - Isn't
  - With role
  - Date related operators (like, yesterday, starting tomorrow, last month, this week and so on)
  - Numeric operators (like, !=, >=, >, between and so on)
  - String operators (like, contains, doesn't contains, starts with, ends with, my teams, and so on)
  Note: The operators displayed vary with respect to the attribute chosen.
- Value - Enter a value for which the condition applies.
  Note: The applicability of this field depends on the operator set. For example, if the operator is set to 'Is empty' this field is not applicable.
A sample criterion configuration is shown in the screenshot below.
You can use the +Add Condition button to add a record and icon to delete a record in this window.
Click Save & Close.The site criteria are configured successfully.