Examples of name similarity

Edit online

This topic presents examples of similar resource names that might be discovered by using the default name similarity settings.

By default, name similarity is configured with the following default settings. For more information on these configuration parameters, see Configuring name similarity.
Parameter Description Values
name_similarity_default_threshold String comparison threshold. For example, a similarity threshold value of 0.9 means that strings must match by at least that value to be considered similar. For more information about the threshold value, see Similarity threshold value.
  • 1 equates to identical strings.
  • 0 equates to completely dissimilar strings.
 0.9
name_similarity_default_lead_restriction Lead restriction. Number of characters at the beginning of the string that must be identical. 1
name_similarity_default_tail_restriction Tail restriction. Number of characters at the end of the string that must be identical. 0
Based on these settings, the following event snippets present an example for resource name similarity analysis. Note that the resource name is stored in the resource column. NODE is the default resource column, but can be changed for the pattern event type.
1     NODE                                        SUMMARY                     ALERTKEY             Similar?
2     acme.env1.base.adm_chk_probeCheck           System Alert SEV2 ABC       adm_probe            No
3     cnz.env2.base.adm_chk_reports               System Alert SEV2 ABC       adm_report           No
4     abc.lyf.base.logs1                          System Alert SEV2 DEF       logs1                No
5     abc.gbs.stato.dotnetcore                    System Alert SEV2 ABC       runtime_down         No
6     caripa.env1.stato.dotnetcore                System Alert SEV2 GHI       runtime_down         Yes
7     caripa.env1.stato.TNT                       System Alert SEV2 GHI       runtime_down         Yes
8     caripa.env1.stato.TNT                       System Alert SEV2 GHI       runtime_down         Yes
9     emperor.env3.stato.pythonRuntime            System Alert SEV2 ABC       runtime_down         No
10    abc.env5.base.bash.total_cpu_noncore        System Alert SEV2 DEF       bash_cpu_noncore     No
11    abc.cio.base.total_cpu_noncore              System Alert SEV2 ABC       bash_cpu_noncore     No
12    banca.env1.base.bosh.jobstate.console       System Alert SEV2 GHI       job_fail             No
As a result of this similarity analysis, the resource names in the NODE column for the events listed in rows 6, 7, and 8 are considered similar. The reasons for this include the following:
  • All of the resource names other than those in the NODE column of rows 2, 6, 7, and 8, start with a letter other than c, hence they are rejected automatically, because the lead restriction is set to 1 character.
  • The resource name in the NODE column of row 2 fails the similarity threshold of 0.9 because it is very different to the resource names in rows 6, 7, and 8.
  • The tail restriction is set to 0, so this allows the resource name in row 6 to pass overall similarity, even though the final letters of its resource name are different to the final letters of the resource names in rows 7 and 8.