Enable Fixed Window Correlation for Super Grouping which will reduce the group size during a rolling window

We have observed that the late arrival of alerts in AIOps can lead to situations where fixed window scope grouping may miss some related alerts during the grouping process. This limitation has prompted consideration of a rolling window concept, which provides greater control over alert grouping. However, challenges arise when there is a "super group," meaning a scenario involving multiple correlations are involved scope, topology or even temporal.

Let's take an example:- 

Requirement is to group alerts within 15 minutes window:

If scope grouping utilizes a rolling window while topology grouping uses a fixed window/rolling window, the system may continue to group alerts beyond the intended correlation window. This lack of control can result in over-grouping or increasing group size, especially if the user requires alerts to be grouped strictly within a specific window (in this case 15 minutes).

Now, why both groupings cannot use a fixed window to solve this issue?

 In version 4.12, it was observed that the fixed window scope grouping did not successfully group all candidate alerts due to late arrival of alerts, even when they should have been included in a single group. Although improvements in alert grouping for late arrivals are expected in upcoming releases, there may still be cases where relevant context is missed. Therefore, the rolling window approach remains the most viable option.

In Netcool, correlation windows are defined (e.g., 15 minutes), ensuring that only matching conditions within the specified timeframe are grouped. This creates a time-bound grouping mechanism. For AIOps, it is necessary to implement a similar time-bound window, particularly in cases of super grouping. Without such limitations, there is a risk of incidents continuing to grow unchecked, impacting operational efficiency.