Section 6 – Bots and Exploring Lambots Supplement the data ingestion settings with optional JavaScripts

Topics In This Section AIOps Objects Why the need to supplemental LAMs with JavaScripts (LAMBots) Anatomy of a Lambot Lambot Basics

AIOps Objects

What Are AIOps Objects? Well Known Less Well Known Events Alerts An instance of specific data on the Message Bus and as records in the Database Well Known Less Well Known Events Alerts Situations Comment Feedback Threads Summary Invitation User

Interacting With AIOps Objects Get The Object Read Properties of the Object Write Properties of the Object Save Object Release Object

Capturing AIOps Objects - Event Lam Lam conf Defines Where and What to get Event filter.presend Names the Lambot that is called for each Event Lambot Lambot. filterFunction ("presend"); Identifies the function to call for each Event Passes the function the Event Object filterFunction Accepts Event as parameter Event properties can be read and written Function return value (true/false) determines destination of Event

Capturing AIOps Objects - Moolets Moolet definition in moog_farmd.conf specifies where and type of object to process Sequencing Moolet B processes the objects exiting Moolet A Specify in Moolet B as process_output_of Moolet A Moobot can specify Moolet B to receive Object Listening for Types of Object Changes Moolet C processes Situation Updates independent of the source of the update Sequencing and Type of Object Changes can be combined Moolet E processes Alert Closes from Moolet D

Moolet – Sequencing moog_farmd.conf – event_streams and process_output_of describe where object is coming from Moolet Class Key Example Alert Builder event_streams event_streams : [“OpenNMS” ], Maintenance, Alert Rules Engine process_output_of process_output_of : [“AlertBuilder”], Sigalizers process_output_of : [“AlertRulesEngine”], Situation Mgr, Teams process_output_of : [“Default Cookbook”, “Speedbird”],

Moolets – Processing by Type of Object Change moog_farmd.conf – event_handlers describe type of object change to initiate Moobot Object Type event_handler Description Event Event, Events A raw Event from Lam Alert Alert, Alerts New Alert AlertUpdate Alert Update AlertClose Alert Close Situation Sig New Situation SigClose Situation Close SigUpdate Situation Update Thread ThreadEntry New Thread Entry Invitation Situation Room Invitation

Moolets – event_handlers Sample Specifying event_handlers in moog_farmd.conf # declare which event handlers the moolet implements event_handlers : [ "Sig", "SigJournal", "SigStatus", "SigUpdate", "ThreadEntry" ],

Reading AIOps Object Properties Use object variable.value(”object property”) to read Example: The presend function is being passed the Event object. Object is stored in event variable Properties are read using value(“property_name”) method function presend(event){ event.value(“description”); event.value(“source”);

Writing AIOps Object Properties Use object variable.set(”object property”, value) to write Example: The presend function is being passed the Event object. Object is stored in event variable Properties are written using set(“property_name”, value) method function presend(event){ event.set(“description”, “This text will become the event’s new description”);

Reading and Writing AIOps custom_info Property object.getCustomInfo() to read custom_info var customInfo = alert.getCustomInfo(); object.setCustomInfo(customInfo) to set whole custom_info where customInfo is a native JavaScript Object alert.setCustomInfo(customInfo);

Saving AIOps Object moogdb methods to update object on bus and database simultaneously Alert moogdb.updateAlert(alertObject) Situation moogdb.updateSituation(situationObject)

Releasing AIOps Object – alert.forward alert.forward is used to propagate Alerts on the message bus alert.forward(this) – propagates Alert to next Moolet. ie the any/all Moolets that have the forwarding Moolet in their process_output_of list alert.forward(“Enricher”) – propagates Alert to a named Moolet. Any Moolets that have the sending Moolet in their process_output_of will not receive Alerts forwarded in this manner. Only the Moolet named in the alert.forward will receive the Alert. Used to conditionally send Alert to Moolets for additional processing

AIOps Objects vs. JavaScript Objects Event, Alert, Situation and others defined by AIOps Properties can only be read using value and set methods Can be passed to functions in Lambots and Moobots as parameters Exist in database and on message bus JavaScript variable of type Object Can be created, modified via Lambots and Moobots Can be passed to functions in Lambots and Moobots as parameters Only exist in memory during the execution of that instance of the bot

LAMBots

LAMs and LAMBots LAMBots consist of JavaScript files that are read by the LAMs The function of the LAMBots is to: Determine whether a detected event is passed onto the system Inspect the event object and make basic modifications to it Replace variables Convert date format Stored in $MOOGSOFT_HOME/bots/lambots What does a Lambot do? It takes the data parsed by Lam, and performs optional processes before the data gets published to the Message Bus. For example, let’s say the “Manager” field of the incoming data is not populated. You can use Lambot to set a value for that field. Or if the event contains data that is not useful for clustering or analysis, then you can have a Lambot discard those values. LAMBots files are found in $MOOGSOFT_HOME/bots/lambots If a full path is not given to a Lambot at the end of Lam config, the Lambot is found in this default LAMBots folder. (of course you can give a full path if you wish)

Creating a Data Ingestion Script (Lambot) Make a copy of the lambot.js (if necessary) If new Lam Make copy of the lam.conf Make copy of the lamd service script Update all the new files Start the new Lam or Restart existing Lam

Making Copy of Config File Copy the default lam.conf i.e. $MOOGSOFT_HOME/config/rest_lam.conf to $MOOGSOFT_HOME/config/rest_lam.CUST.conf Note the naming conventions for smoother support process <filename>.<customer_identifier>.<file_extension> Consult the File Naming Convention document for more recommended rules Change port, log and presend parameters When you need to create a new Lam, we recommend to start by copying the default Lam that shipped with the product to start. The copied Lam should be stored and named following the suggested conventions, so should you need Moogsoft support to investigate an issue, Moogsoft agents can easily locate components. This will also avoid the risk of accidentally overwriting your Lam when you upgrade the system. There are other best practices when configuring a Lam. The name is going to be used as a data source in the AIOps UI, so make sure to make it meaningful and recognizable to your team. Consult the File Naming Convention documentation for more.

Making Copy of Service Script Copy the default Lam to start i.e. /etc/init.d/restlamd to /etc/init.d/yourlamd Note the naming conventions for smoother support process <filename>.<customer_identifier>.<file_extension> Consult the File Naming Convention document for more recommended rules Change SERVICE_NAME, PROCESS_NAME and CONFIG_FILE parameters Install with : chkconfig yourlamd on When you need to create a new Lam, we recommend to start by copying the default Lam that shipped with the product to start. The copied Lam should be stored and named following the suggested conventions, so should you need Moogsoft support to investigate an issue, Moogsoft agents can easily locate components. This will also avoid the risk of accidentally overwriting your Lam when you upgrade the system. There are other best practices when configuring a Lam. The name is going to be used as a data source in the AIOps UI, so make sure to make it meaningful and recognizable to your team. Consult the File Naming Convention documentation for more.

Sample Lambot Configuration onLoad function Sets/Reads constants Used to initialize Lambot Only called when Lambot is initially loaded Every Lambot has to define two functions - onLoad() and presend(). OnLoad() is run by every threaded instance of the Lambot at start-up. When this file is loaded in and a new Lambot thread is created the function is called. By default there are 10 threads for every Lam. Therefore, Moogsoft recommends that you setup shared values or lookup tables in the onLoad() function. The following process is defined in this example: Examine the constants module to see if it contains a value at "key1" If not store the value 2 at "key1" Then output using the logger module whether "key2"contains a value (result should be false)

Sample Lambot Configuration presend function Is passed the event Should Return true only if event should be processed You must then define a presend function which is called every time the Lambot assembles an object that it will publish on the /Events bus for processing by farmd, and subsequently turning into alerts and Situations. Presend takes as an argument, event, which is a built-in utility object CEvent. It will return either a Boolean or a special type of object that will allow you to define both the true and false as to whether or not to pass the object out to the events bus.

Lambot & Field Overflow Data field not mapped to AIOps event fields by lam.conf can be passed to Lambot using catchAll statement in mapping section of Lam config file The value of the catchAll property becomes the name of the object variable in the Lambot

Event Objects Functions Object Function Description contains(name) Returns true if the Event contains a value stored at the key name. set(name,value) Associates the specified value with the specified name in the Event. Previous key mapping has the old value replaced. Returns true if the operation was successful value(name) Returns the object stored at the key name

Lab 6 – LAMBots Modify a Lambot Lab 6a Logging Messages Lab 6b Show What You Know Lab 6c Modify Event Properties Lab 6d Modify Event Custom_Info These labs took about 30 minutes

Questions