A Drools event accumulator using the Event Correlator

Purpose

A set of Drools rules that leverage the existing flap-detection helpers in order to maintain a count of events received within a configurable interval and emit an event when the count is exceeded. I am not an expert at Drools, this was primarily done as a learning exercise and may not follow the rules of best practice or sanity.

Installing

• Enable the Correlator in $OPENNMS_HOME/etc/services-configuration.xml

• copy drools-engine.xml to $OPENNMS_HOME/etc/

• copy the entire drools-engine.d to $OPENNMS_HOME/etc/

• modify the drools-engine.xml for your desired interval, event count, and event UEIs.

• add event defintions for the /Rollup events (i.e. uei.opennms.org/test/testtest1/Rollup)

• cross your fingers and restart OpenNMS

Usage

As described. The log output from drools is written to logs/DroolsCorrelationEngine-*.log The event parms from the triggering event are copied into the rollup event, so it would probably be helpful if all the event UEIs use the same parms and values, but we don’t actually check for this.

Questions?

Ping @dino2gnt in the OpenNMS Mattermost chat