Deduplication
Occurrences of the same event are deduplicated into a single alert instance.
The default correlation policy constructs a deduplication key for events from the following elements:
{{ event.resource }}-{{ event.type.classification }}-{{ event.type.condition }}
When the same event occurs multiple times (the resource, classification, and condition fields are the same), then deduplication increments the event count of the current alert instance to show how many times the event occurred.
Problem events (type.eventType = problem) create an
alert (if one does not exist). Meanwhile, resolution events
(type.eventType = resolution) do not become alerts and
are not visible in the Alert Viewer. They clear an alert if one
exists and ignore if none exists. For a resolution event to clear a
problem alert instance, it must have the same deduplication key as
the problem event that the alert was created from. Also, it must
have occurred after the last problem event that contributed to the
alert.
Type fields and alert correlation
Since the same alert arises for all events with same type
fields, these fields must clearly indicate the specific fault
condition and have separate values for different conditions. The
resource fields are important for both alert correlation and
topology lookups. Therefore, they must accurately describe the
resource that exhibits the fault condition. By default, alerts with
the same resource.name field that occur within 15
minutes of each other are correlated together.
Additionally, all resource fields are used to look up each alert in the topology. Therefore, where possible one or more of these fields must be in the same form as the match tokens for the corresponding topology resource.
Alerts are also correlated by using temporal correlation. Temporal correlation looks for historic patterns of co-occurrence and uses this information to predict future correlation. This correlation relies on consistent value of the type fields over time for the same conditions against the same resources. Therefore, the values of these fields must be deterministic.