Clustering Engine

The clustering engine is a correlation engine that uses the DBSCAN algorithm to build alarm clusters. It draws information from the locally persisted network inventory graph. ALEC automatically creates and maintains this graph, which is based on information from the associated datasource.

DBSCAN algorithm

The DBSCAN algorithm that forms the basis for the clustering engine measures the distance between alarms on the network inventory graph to determine whether they should be correlated into a cluster. The distance function calculates a weighted combination of distance in both time and space (on the shortest possible path between affected nodes) between alarms.

Hellinger distance

The clustering engine can use Hellinger distance calculations to more accurately render the distance between alarms. ALEC uses the results of its calculations as scaling variables. Alarms are pushed further apart if the value is high, and vice versa.

You can enable Hellinger distance calculations when you configure the clustering engine, or by updating your engine configuration settings:

  1. Click Plugins > ALEC in the top menu bar.

  2. Click the gear symbol in the top-right of the screen.

  3. Select With Hellinger Distance, and click Save Changes.

You must use the clustering engine to enable Hellinger distance calculations.

Performance

The clustering engine performs well when fewer than 500 candidate alarms exist. You can use the clustering engine on monitored networks that periodically experience more than 500 active alarms, since many of them will age out over time. The ALEC plugin’s performance may degrade when more than 500 active candidate alarms exist in your OpenNMS instance.

Note that ALEC considers only recent alarms (created or updated within the previous two hours) as candidates for correlation. You can configure the interval that ALEC uses to determine which alarms are candidates for correlation.