Moogsoft Docs

Release Notes

Moogsoft AIOps v7.0.0 ESR

Moogsoft AIOps v7.0.0 is an Enterprise Stability Release that introduces the following key features:

Situation Topology : New Topology tab in the Situation Room displays a visual representation of the connections within a Situation, based on topological data for the relevant nodes.

Cookbook Value Recipe V2 : Cookbook has a new default value recipe with improved text similarity matching. Vertex Entropy, hop count and seed alert filter settings have also been added to the Cookbook configuration in the UI.

New Team Dashboards : Insights now includes two new default dashboards. The Team Ops and Team Performance dashboards are both available when using Grafana.

Team Assignment : You can now assign teams to a Situation from the Situation Room. This overrides the team's service filter in the settings for the Situation.

SAML Enhancements : Additional mappings have been added as part of a number of SAML improvements.

Moogsoft AIOps v7.0.1

One additional fix is present in v7.0.1 compared to the original v7.0.0 release. This fix is documented below:

Key Release Note

The Moogfarmd process no longer takes a long time to become responsive in systems using Maintenance Mode with a large number of alerts.


Updated version: v7.0.1.9

The latest version of Moogsoft AIOps v7.0.1 is v7.0.1.9. This contains the following bug fixes:

  • INT-5520: Corrects a JDBC_lam query issue related to an Oracle database.

  • MOOG-13546: Improves validation of the integration name field. Now validation allows only alphanumeric characters and underscores.

  • MOOG-14400: Failover and startup logging of Moogfarmd is now logging the values correctly.

Refer to Moogsoft AIOps v7.0.0 Updates for details on all updates to this version.

Install & Upgrade

To perform a new Moogsoft AIOps installation without root user access, see Single Host Installation for Non-root .

To perform a new installation, see Pre-install RHEL 7/CentOS 7 or Pre-Install AIOps - Offline RPMs for an offline installation, then follow the instructions for one of the following:

Supported upgrade paths for this version include:

This release uses the moog_db_auto_upgrader to upgrade the database and run any 'data migration utilities'.

For more information see Moogsoft AIOps 7.0.0 Supported Environments .

Release Highlights

Key Feature Release Note
MOOG-9602 Situation Topology

Moogsoft AIOps can now use topological data to present a visual representation of connections between the hosts impacted by a Situation. Each host in your system is a potential node in the topology.

When a Situation affects more than one node and Moogsoft AIOps has topological data for those nodes, you can use the Situation Room Topology tab to:

  • View nodes involved in a Situation and the links between them.
  • View nodes that neighbor involved nodes.
  • View related alerts and filter alerts.
  • Set the relative node size to indicate Vertex Entropy or Probable Root Cause (PRC).

See View Situation Topology for more details.

The Next Steps tab in the Situation Room displays the most important nodes in the Situation Topology.

MOOG-9673 Cookbook Value Recipe V2

CValueRecipeV2 extracts and analyzes groups of consecutive characters to measure text similarity between alerts. It is the default Recipe in Cookbook for new v7 installations and for any new Cookbooks you create.

This recipe uses the bag-of-words model and shingling natural language processing methods to calculate the text similarity between alerts. Shingling is the process in which Cookbook extracts groups of consecutive characters called shingles from a source string. Potential sources include the alert source ID or description. To measure similarity, Cookbook calculates the number of identical shingles.

See Recipe Types for more information.

MOOG-9893 Team Assignment An Operator can now assign teams to a Situation in the UI. Once this action is performed, teams can no longer be automatically assigned to the Situation.
- SAML Enhancements

Improvements to SAML configuration mean additional attributes map to Moogsoft AIOps from the SAML provider when users log in.

The new mappings in $MOOGSOFT_HOME/config/security.conf include:

  • contactNumber
  • department
  • primaryGroup
  • timezone
  • assignTeams
  • assignRoles

See Configure Single Sign-On with SAML for details about configuration and available mappings.

There are also three new Graze API endpoints that allow you to retrieve, create and update a SAML realm.

- Team Dashboards

Two new dashboards and their associated Stats API endpoints are now available as part of Insights:

  • Team Ops provides a broad overview of your team's Situations.
  • Team Performance provides insights into your team's workload and performance.

See Grafana Dashboards and Stats API for more information.

If you use on-prem Grafana, you will need to upgrade your instance to support the latest Moogsoft AIOps plugin enhancements. See Grafana documentation for details.

- New Integrations

A number of new integrations have been added and existing integrations have been improved. These include:

  • A new Datadog Polling integration enables Moogsoft AIOps to collect event data from Datadog.
  • A new ExtraHop integration allows you to retrieve alerts from ExtraHop and send them to Moogsoft AIOps as events.
  • New integrations allow Moogsoft AIOps to ingest alert data from Azure Classic and Azure Monitor .
  • A new SevOne integration enables Moogsoft AIOps to collect alert data from SevOne.
  • A new Sumo Logic integration allows you to retrieve alerts from Sumo Logic and send them to Moogsoft AIOps as events.
  • A new Tivoli EIF LAM allows you to retrieve Tivoli Event Integration Format (EIF) messages and send them to Moogsoft AIOps as events.
  • Several LAMs can now integrate with multiple targets.
  • The Slack integration can now automatically post newly created Situations to Slack and automatically post comments in a Situation to Slack.

New Features

Key Release Note

The JDBC LAM can now poll multiple database targets.


A single SolarWinds LAM instance can now integrate with multiple SolarWinds servers.


A single Zabbix LAM instance can now monitor multiple Zabbix servers.


A single vRealize Log Insight LAM instance can now integrate with multiple vRealize Log Insight servers.


A single HP NNMi LAM instance can now monitor multiple HP NNMi servers.


A single Zenoss LAM instance can now integrate with multiple Zenoss servers.


A new Tivoli EIF LAM has been added. See Tivoli EIF for more information.


A new SevOne integration has been added. See SevOne for more information.


A new Sumo Logic integration has been added. See Sumo Logic for more information.


A new ExtraHop integration has been added. See ExtraHop for more information.


New integrations for Microsoft Azure have been added. See Azure and Azure Classic for more information.


A new Datadog Polling integration has been added. See Datadog Polling for more information.


A single Dynatrace APM LAM instance can now integrate with multiple Dynatrace APM servers.


A single Email LAM instance can now integrate with multiple Email servers.

MOOG-9602 A Topology tab has been added to the Situation Room. See View Situation Topology for more details.
MOOG-9673 The new Cookbook Recipe V2 uses an improved matching algorithm that enables a higher level of accuracy when creating Situations. It includes a greater degree of granularity and configurability.
MOOG-9893 An Operator can now assign teams to a Situation in the UI. Once this action is performed, teams can no longer be automatically assigned to the Situation.


Key Release Note

A new method getPreviousData has been added to alert and Situation objects within Moobots. It returns a JSON object containing the previous values of a Situation that has been changed.


A severity icon is now displayed next to the severity fields in field mappings.


The Webhook integration has been updated with a Base64 encoded Basic Authorization field.


REST based integrations are now relaxed with regards to which 'content-type' is provided in incoming requests, the value simply needs to contain 'json' for the payload to be decoded as JSON, likewise for 'xml' and 'yaml'


The duplicate_source configuration in LAMs has been improved, specifically with regard to the duplicate detection mechanism. moog_farmd.conf contains a new property duplicate_event_source.time_window which can be used to determine the time window in which two identical events from different sources are considered to be the same event.


RabbitMQ LAM can now be specified with multiple brokers (RabbitMQ nodes) which allows the LAM to recover to other nodes within the cluster.


The Slack integration has been updated with options to automatically post newly created Situations to Slack, and automatically post comments in a Situation to Slack. The text box prompt has been removed from the URL tool and the default channel field has been removed from the integration configuration.


The Jira and Jira Service Desk integrations can now transition corresponding resolved Situations to "Closed" if the Jira ticket transitions from resolved to the literal status "Closed".


HP NNMi LAM does not poll incidents that are in Dampened state.


The Logfile LAM now supports date formats and numbers in the logfile name as wildcards, so that during file switchover the LAM can continue ingesting from the new file without having to be reconfigured and restarted.


The Logfile, Kafka and Socket LAMs can now map XML inputs to JSON.


The Email LAM now supports the configuration for a Web, SOCKS (V4 or V5) proxy. Authenticated proxies are not supported.


The AWS CloudWatch integration now supports role-based delegation for cross account access in order to fetch CloudWatch alarms and CloudWatch log events.


LAM configuration files no longer specify the cluster attribute for high availability. It is inherited from $MOOGSOFT_HOME/config/system.conf by default.


OEM, Splunk and Syslog LAMs now listen on by default rather than localhost.


In LAMs when specifying a timeFormat converter you can now specify a timezone configuration so that the LAM parses the incoming timestamps with the expected timezone. You can specify the timezone name or abbreviation. See List of TZ Database Time Zones for the full list.


The Kafka LAM is now configured to receive JSON messages by default.


A new property expose_request_headers has been added to the REST LAM. When it is set to true:

  • Headers received in requests to REST-based LAMs are forwarded to the LAMbot in a new field moog_request_headers
  • The headers are added to each event under the key moog_request_headers

The CA UIM integration has been improved to expose all values received in the PDS payload.


The Webhook integration now includes a cURL example with the connection details automatically completed.


The New Relic Polling integration now supports proxy communication.


In Zabbix LAM configurations the request overlap value no longer needs to be less than request interval. The request overlap property now requires overlap identity fields to be set or disabled for the REST client and Zabbix. Request overlap is now disabled in the default REST client configuration.


EMSClose functionality has been added to the SCOM LAM.


The Utilities module can now be used to convert an XML string to a JSON object, which is easier to manipulate in JavaScript. It can also convert a JSON object to XML for external communication that requires XML input.


The UI now supports the use of number and boolean fields in checkboxes.


Port 3000 is no longer required in the Grafana access URL. A proxy pass rule has been added to Nginx to redirect http://domain.grafana/ to port 3000.


Diagnostics for the High Availability Control utility (ha_cntl) now provide the full stack trace of a checked out connection.


The Database Auto Upgrader utility (moog_db_auto_upgrader) now upgrades from a patch version as well as any other version.


The Graph Analyser utility (graph_analyser) can now update Vertex Entropy values based on topological updates.


Cookbook Recipe filters in the UI now include an option to filter by Vertex Entropy.


The Process Control utility (process_cntl) now include a loglevel option which can be used in the following format:
process_cntl [ [--process_name] <name>] [--service_instance <instance>] [--loglevel <level>] {start|stop|status|restart|help}
For example: process_cntl --process_name moog_farmd --loglevel DEBUG restart


A  case sensitivity checkbox has been added for each clustering option in the Cookbook Recipe UI form.


The Tomcat log now warns of any attempt by an inactive user to log into the system.


Two new settings have been added to System Settings in the UI under Customization > Interface Settings. Administrators can now set a default timezone, which is used for new users if no timezone is specified on user creation. An "Allow users to select time zone" checkbox has also been added. When unchecked users cannot change their own timezone from My Account panel. The UI wording "Use System Time Zone" has been changed to "Use Client Time Zone" to better reflect its function.


When failover occurs from one MySQL, RabbitMQ or ElasticSearch connection to another, a warning is logged containing details on the connections. When a farmd process failover occurs a warning is logged before the failover starts and after it completes. The following command must be run as part of an upgrade script: -f -w


The Grafana Dashboards SQL queries for top 10 teams and top 10 services have been improved to be more efficient.


The Cookbook Recipe form in the UI now includes a Recipe Type drop-down for versions 1 and 2. When 'Value Recipe v2' is selected, users can choose word or shingle language processing and there is no option on the Clustering tab to set case sensitivity. Default recipes now use version 2, but existing recipes remain unchanged.


A description of Cookbook Recipe V2 has been added to the moogfarmd configuration file. Matcher settings for default Cookbook Recipes have been tuned.


The Cookbook Recipe form in the UI now includes a Seed Alert filter.


The Cookbook Recipe form in the UI now includes a Hop Limit setting.


A custom attribute can be used to set user roles during SAML authentication. This is done using the roleAttribute property in Security.conf.


The Situation Room Next Steps tab now includes a new section Topology View and Important Nodes.


Contact Number, Department, Primary Group, and Timezone can now be configured during SAML authentication.


A hypothesis test is now used in the Tempus algorithm to check whether a cluster is significant. Only significant clusters are turned into Situations.


A select all checkbox has been added to the Situation and alert lists. The checkbox is active when all records in the list have been loaded.


The following changes have been made to the Zabbix integration:

  • An event GET request to Zabbix now includes the selectTags and select_acknowledges parameters with the value "extend". This information is available in custom_info.
  • After receiving events from Zabbix, an additional request for trigger Get is executed. This resolves macros and functions in the description, comments and expression of the event's related object. For example, "{HOST.NAME}" in the description resolves to the actual name of the host.
  • If a Zabbix event contains multiple hosts, an event per host is now sent to Moogsoft AIOps.
INT-4134 Zabbix LAM now supports a configurable request overlap (requests_overlap property) which allows the LAM to find events in Zabbix that were added retroactively. To prevent duplication of the same event, events that have already been seen before are ignored. This is configurable via the overlap_identity_fields in the configuration file. By default the eventid is used to determine an event's uniqueness.
INT-4060 Log file consistency has been improved in the Email, vCenter, vRealizeLogInsight and vSphere LAMs.
INT-4082 User authentication has been improved in the JIRA Service Desk and JIRA Software integrations.
INT-3862 Comments in JIRA Software and JIRA Service Desk can now be rendered as plain text in Moogsoft AIOps. This feature is disabled by default but can be enabled in the Moobot.
INT-3408 Error alerts generated by the CA Spectrum integration have been improved.
INT-4160 The Cherwell integration has been improved to display alert severity in a Cherwell incident as a description rather than a number.
INT-4248 LAM log files are now saved to the location $MOOGSOFT_HOME/log/data-capture/

The following changes have been made to REST-based LAMs:

  • A performance issue with SSL handshake has been resolved.
  • Lists at the root of YAML input are now supported.
  • Requests with an unsupported content type are now rejected with the HTTP code 415 (Unsupported Media Type). Code 406 (Not Acceptable) was previously used.
  • The accept_all_json property now defaults to true when not provided.
  • The field status_code in the response from the GET method calls has been renamed to statusCode to match the field name in the response from POST and PUT methods.
  • The response from the REST LAM is now pretty-printed.
INT-4180 The AWS CloudWatch LAM now supports the aws_all_regions property for event collection from CloudWatch logs. This allows the LAM to gather events from all reachable regions within the specified account. Enabling this can cause a vast amount of data to be ingested, so we recommend specifying regions and applying filters. This functionality is not applicable to the AWS CloudWatch integration in the UI.
MOOG-10146 The efficiency of some insights statistics collections queries have been improved.

The getSystemStatus endpoint has been improved as follows:

  • A new config parameter max_heartbeat_delay in system.conf controls the amount of time that a missing heartbeat is considered missing.
  • The heartbeat messages have a higher priority than before.
  • The getSystemStatus endpoint returns latest_heartbeats for each service holding the latest heartbeat.
MOOG-9878 The UI can now be directly accessed with https://moogURL
MOOG-10125 All moogdb database tables now include a primary key to aid in supporting various MySQL clustering methods.
MOOG-10166 The reliability of moogfarmd in high availability environments has been improved. Failover has been redesigned and the message bus is now resilient to network failure and can recover without losing data during the recovery process.
MOOG-9839 A validation script has been added to the non-root installer.

Bug Fixes

Key Release Note

Email integration header mapping names are now consistent. See Configure the Email LAM for mapping details.


REST-based integrations created in the UI now accept all HTTP methods, for example GET, PUT and POST.


An error message is now displayed when attempting to load the details page for an integration that does not exist.


A console error no longer occurs when installing certain integration types.


Superfluous and misleading PCRE greedy modifier conversion logging has been removed.


Client tools used by integrations can no longer be deleted through the UI.


The default mapping in the CA UIM integration has been improved and a connection retry property has been added.


A memory leak in the CA Spectrum integration has been resolved.


Proxy properties are now commented out by default in the REST Client LAM configuration file.


The Dynatrace Notification integration now separates the source and source_id.


An issue with multiple regions for CloudWatch Logs has been resolved.


The URL to link to a Situation from ServiceNow has been corrected.


Redundant ServiceNow user information has been removed from the work note sent from ServiceNow to Moogsoft AIOps.


Unnecessary configuration options have been removed from REST LAM configuration files.


Email, HP NNMi, vRealize, vSphere and Zenoss LAMs no longer fail silently when a configuration issue causes them to fail to initialize.


Zabbix events are now requested from the Zabbix server in ascending order, to ensure that they are processed in order of occurrence.


An error relating to group names for HA addresses being larger than the actors table has been fixed and HA LAMs are now working as expected.


The mooms_cache_lam.conf file has been updated to pass custom_info rather than overflow in its mappings.


An issue with the AWS integration which prevented subsequent polls from fetching alarms correctly has been resolved.


SCOM Advanced Connector now sends alerts in batch size of up to 10 MB. The batch size is configurable.


LAMs and integrations now correctly utilize the start_as_passive settings within the HA section in configuration files.


Multiple xMatters notifications are no longer sent when the alert tool is run.


The accept_conn_when_passive property now defaults to false in all LAMs, with the exception of REST-based LAMs where it defaults to true. If a LAM is required to support connections when passive, set accept_conn_when_passive explicitly in the HA configuration.


An issue which caused ConcurrentModificationExceptions to occur has been fixed. In addition, the following LAMs now log capture data as JSON, where applicable: AWS CloudWatch, CA Spectrum, CA UIM, Dynatrace Synthetic, Email, HP NNMi, HP OMi, JMS, RabbitMQ, SevOne, VMware vRealize Log Insight, VMware vSphere, WebSphere MQ, Zabbix.


The Collaborate tab in the Situation Room no longer renders the browser temporarily unresponsive in some circumstances.


The Situations filter now displays Situations in ascending numerical order.


An XSS vulnerability in the full name user field has been resolved.


An XSS vulnerability on the search results page has been resolved.


User, filter and team names can no longer be used to trigger javascript code in the system settings panel.


The resolving step indicator for Situations is now correctly displayed.


Custom info merge tools are now working correctly.


Custom field links are now always updated when expected.


Inactive and duplicate users no longer appear in the list when inviting users to Situations or assigning users to Situations and alerts.


Situation room hotkeys are now working reliably.


Collections of values in custom info are now correctly displayed.


The Situation similarity cache no longer loses integrity under certain conditions in high event rate.


The tools menu options for Situations and alerts are no longer active when no Situations or alerts are selected.


The Maintenance Window dialog scroll has been improved.


Default thread names are no longer erroneously shown on posts in the Collaborate panel on mobile.


There is no longer a delay when displaying a large number of maintenance windows.


An invalid alert filter no longer displays all alerts in some circumstances.


Mobile users can now assign a Situation to themselves.


The "Invite user" hotkey in the Situation list no longer enters a stray letter in the Users search box.


The entropy_threshold is no longer ignored by Tempus sigaliser in some circumstances.


Duplicate thread entries in the Situation Room Collaborate tab are no longer created when multiple alerts are closed or resolved. You can now close multiple alerts at a time using the closeAlert command. For more information see Graze API and MoogDb V2 .


The ID column in the Situation list now automatically expands to display all Situation IDs.


The behavior of the Tools menu in the Situation and alert lists is now consistent with the rest of the UI.


The TemplateMatcher Moolet has been removed.


MySQL, Elasticsearch and RabbitMQ data for non-RPM installations has been moved from $MOOGSOFT_HOME/cots to MOOGSOFT_HOME/var/lib.


A MySQL exception that was impacting Auto Close has been resolved.


Tomcat no longer crashes if the default team in security.conf is not present in the database. The default team is created and a warning logged to catalina.out.


If the Graze endpoint setPrcLabels is called with invalid alert/Situation IDs (alerts and Situations that do not exist in the database) the server now returns HTTP status code 400 instead of 200.


The change password option is no longer available in the UI for users that have logged in via SAML.


Backwards navigation now works correctly on Chrome for iPhone.


Moogfarmd now properly validates database pool initialisation errors on startup.


The Persistence Store function in HA environment has been corrected for all Sigalizers. In case of failover, alerts are not re-added to random situations.


The moogfarmd process no longer throws exceptions when two failovers occur in an active/passive setup.


MTTx statistics now include Situations that were created more than an hour ago but were only acknowledged/resolved during the past hour. This change only affects the statistics displayed in Grafana.


Auto Close now works correctly with custom info related filters.


Unnecessary validation checks for JAVA_HOME have been removed.


The moogfarmd process no longer throws exceptions when the Enricher Moolet is chained to a Sigaliser and message_persistence and persist_state are set to true in $MOOGSOFT_HOME/config/system.conf.


Two instances of moogfarmd are no longer activated if there is a delay in activation after auto recover.


The Rate Filter checkbox in the Cookbook Recipe UI now displays correctly in Safari.


Field names no longer appear empty in Cookbook Recipe clustering options in some circumstances.


The initialization script now sets the correct crontab environment variables.


The Elasticsearch setting rootLogger.level is now set to warn as part of the script. This setting can be changed in to configure additional logging for Elasticsearch.


An error no longer displays when a user logs into the UI for the first time.


Certain alerts are now correctly removed from their maintenance windows after the windows have expired.


A few extraneous columns have been removed from the media table. The location of each media file is now relative to the cache_root configuration in servlets.conf.

Deprecation Notices

Known Issues

Key Release Note
PIR-1820 Improvements in the stability and reliability of the Indexer moolet have increased the time taken to index 100,000 Situations by approximately 8 seconds.

LDAP and SSO users do not inherit SMS settings by default. Manually edit your notification preferences as a workaround. De-select "Use System Defaults" and check the appropriate types of notifications to receive.

PIR-1884 Two automatically generated keystores for SAML are shipped in the 'Installer'/Non-root version of Moogsoft AIOps. Remove these files from $MOOGSOFT_HOME/etc/saml before using SAML.

The manifest file generated by the build process is incorrectly named. This can prevent Moogsoft AIOps Mobile UI users from adding a shortcut to the home screen.

INT-4374 SevOne LAM logs are written to the location $MOOGSOFT_HOME/logs/data-capture. All other LAM logs are written to $MOOGSOFT_HOME/log/data-capture.
INT-4504 In the custom payload for the Dynatrace Notification integration, {ProblemDetails} is now {ProblemDetailsText}.

Release Date


For information on previous Enterprise Stability Releases see Moogsoft AIOps Releases .