Introduction to Skylar Analytics

Skylar Analytics includes the following components:

• Data Visualization. Enables SQL-based dashboards and charts based on data gathered by Skylar AI and Skylar One. Data Visualization is achieved using a ScienceLogic-hosted instance of Apache Superset.
• Data Exploration. Enables third-party tools that use the Open Database Connectivity (ODBC) interface to access the metric data from Skylar AI. This component lets you use ODBC to connect Skylar AI data with applications like Tableau, Microsoft Power BI, or other business intelligence tools.
• Anomaly Detection. Uses always-on anomaly detection to find metric outliers in Dynamic Application time series data. It also computes an anomaly score that characterizes the significance of each anomaly. You can view anomalies for all Dynamic Application metrics for a device by visiting the Anomaly Detection tab on the Device Investigator page for that device.
• Predictive Alerting. Helps to avoid problems such as file systems running out of space, hosts running out of memory, or issues with network reliability due to oversubscription. The alerts appear as enriched events within Skylar One.

For an overview of Skylar AI, see Getting Started with Skylar AI.

This video provides an overview of the different features of Skylar Analytics: https://player.vimeo.com/video/990317575?h=74e1aca2bf

To view the latest Skylar Analytics release notes, see the Skylar Analytics Release Notes.

What is Skylar Analytics?

The Skylar Analytics suite of services uses data gathered by Skylar One to explore data, generate visualizations, and monitor IT infrastructure metrics. Skylar Analytics can also use Skylar AI to predict alerts before they happen, and detect anomalies that could become events that might disrupt your IT infrastructure and functionality.

Skylar One uses port 443 to communicate with your Skylar Analytics system. Skylar AI does not require a port.

Skylar Analytics includes the following components:

• Data Visualization. Enables SQL-based dashboards and charts based on data gathered by Skylar AI and Skylar One. Data Visualization is achieved using a ScienceLogic-hosted instance of Apache Superset.
• Data Exploration. Enables third-party tools that use the Open Database Connectivity (ODBC) interface to access the metric data from Skylar AI. This component lets you use ODBC to connect Skylar AI data with applications like Tableau, Microsoft Power BI, or other business intelligence tools.
• Anomaly Detection. Uses always-on anomaly detection to find metric outliers in Dynamic Application time series data. It also computes an anomaly score that characterizes the significance of each anomaly. You can view anomalies for all Dynamic Application metrics for a device by visiting the Anomaly Detection tab on the Device Investigator page for that device.
• Predictive Alerting. Helps to avoid problems such as file systems running out of space, hosts running out of memory, or issues with network reliability due to oversubscription. The alerts appear as enriched events within Skylar One.

The other chapters in this manual cover each Skylar Analytics component in detail.

Getting Started with Skylar Analytics

These instructions are only for on-premises configurations of Skylar AI. The ScienceLogic SRE team performs these steps for SaaS configurations of Skylar AI.

Before you can start using Skylar Analytics, you will need to perform the following configurations in Skylar One to enable the export of data from Skylar One to Skylar:

• Create a Service Connection
• Enable Skylar Analytics for one or more organizations

After you perform these configurations, you can access Skylar Analytics and other key Skylar AI components from the Skylar AI page () in Skylar One.

For information about setting up users, user groups, and user roles, see Configuring Skylar AI System Settings.

ScienceLogic strongly recommends that you always use the most recent Skylar One and AP2 releases in conjunction with the most recent Skylar AI release. Using the most recent releases will ensure that your Skylar AI system has access to the latest datasets and features. For more information, see the Skylar One Platform and AP2 Release Notes.

Creating a Service Connection

If you are using AP2 Mochi or later with your Skylar One system, you can create a service connection for the Skylar AI engine on the Service Connections page (Manage > Service Connections) in Skylar One. ScienceLogic strongly recommends that you upgrade to Mochi or later. For more information, see the AP2 Mochi release notes.

The service connection enables communication between your Skylar One system and Skylar AI. This process replaces the Running the Skylar Management Tool process in previous releases of Skylar Analytics and Skylar One.

To create a Skylar AI Engine service connection:

1. In Skylar One, go to the Service Connections page (Manage > Service Connections).

2. Click Add Service Connection and select Skylar AI Engine. The Create Skylar AI Engine Credential window appears.

3. Complete the following fields:
   

• Name. Type a name for the new service connection.
• API Key. Add the access token for Skylar AI, which you can generate on the Access Tokens page in Skylar Settings (Instances > Access Tokens). For more information, see Creating Access Tokens for Users.
• Skylar AI Engine URL. Add the URL for your Skylar AI system.

4. Click Save. The service connection is added to the Service Connections page, and a modal displays a link to the Organizations page, where you can enable Skylar Analytics for one or more organizations. See the following procedure for more information.

5. Refresh or reload the browser to add all updates to Skylar One.

   Newer releases of Skylar One include a Status and Status Updated column, along with a Service Check column that displays a Run Test button for "Skylar AI Engine" service connection types. Click Run Test to run a script to check the status of the Skylar AI connection and display the results in a modal.

Enabling Skylar AI for One or More Organizations

You will need to select one or more organizations in Skylar One that will share data with Skylar AI. This data will come from all of the devices in a selected organization. By default, the Skylar AI features are disabled.

You can see which organizations are currently sending data to Skylar AI by going to the Organizations page (Registry > Accounts > Organizations) and looking at the Skylar AI Status column for the organizations.

To enable Skylar AI with Skylar One organizations:

1. In Skylar One, go to the Organizations page (Registry > Accounts > Organizations) and click the check box for one or more organizations.

2. In the Select Action drop-down, select Send Data from Selected Orgs to Skylar AI and click Go to start sending data about the selected organizations to Skylar AI. The Skylar AI Status column for the selected organizations changes to Enabled.

3. If you want to override the hard-coded default options for exporting metadata to Skylar AI, you can add the JSON values in the Skylar Options (JSON) text field on the Behavior Settings page (System > Settings > Behavior). the values entered must be in the same JSON structure as those that appear in the config.py file:

   DEFAULT_OPTIONS = { "metadata": { "intervals": {"snapshot": 60,
   "cleared_events": 5}, "snapshot": { "batch_sizes": { "asset_basic":
   500, "asset_ip_config": 10000, "perf_index_label": 5000, "device_
   config": 20000, }, }, "cleared_events": { "query_range": 60, }, } }

You can use the "Skylar: Failed" event policy in the "Skylar One Default Internal Events" PowerPack to raise an event in Skylar One if Skylar fails. If you installed Skylar One version 12.5.1 from an ISO file, this PowerPack will be included with the installation. If you are upgrading to Skylar One version 12.5.1, you will need to download the most recent "Skylar One Default Internal Events" PowerPack from the PowerPacks page on the ScienceLogic Support Site (Skylar One > PowerPacks) and then install the PowerPack.

For Older Versions: Running the Skylar Management Tool

If you are using a version of AP2 before Mochi, you will need to set up Skylar AI with the steps below for the Skylar SL1 Management Tool instead of the Service Connections page in Skylar One. ScienceLogic strongly recommends that you upgrade to Mochi. For more information, see the AP2 Mochi release notes.

The Management Tool configures Skylar One data and Skylar One processes, and it starts monitoring the Skylar connection and configuration. The script is named sl-otelcol-mgmt.py, and it is included in the sl-otelcol RPM package.

To run the Skylar SL1 Management Tool:

1. Use the following command to run the Management script on the Database Server (a Skylar One Central Database or a Skylar One Data Engine):

   sudo sl-otelcol-mgmt.py -vv skylar --skylar-all --skylar-endpoint "<URL_for_skylar_system>" --skylar-api-key "<skylar-access-token>" --ap2-feature-flags

   where:

   • <URL_for_skylar_system> is the URL for your Skylar AI system
   • <skylar-access-token> is the access token for Skylar AI, which you can generate on the Access Tokens tab of the Skylar Settings page. For more information, see Creating Access Tokens for Users.

This command configures the OpenTelemetry Collector, restarts services that export data, and checks that connectivity to the supplied endpoints is healthy.

You can also use the following configuration options if needed:

• --verify-cert false. Allows users in on-premises environments to connect to Skylar AI using self-signed certificates.
• --ca-bundle /<path>/bundle.pem. Allows users to specify a path to a .pem file and assign it to the REQUESTS_CA_BUNDLE environment variable.
• --skylar-disable. Stops all Skylar AI exports and services. This flag performs the same operations as the pause command (see step 3, below) and also removes any Skylar AI pages from the Skylar One user interface.

If you have already run setup before and are not changing the connection details, you do not need to include --skylar-endpoint "<URL_for_skylar_system>" --skylar-api-key "<skylar-access-token>".

In addition, --ap2-feature-flags is only needed the first time you install Skylar AI.

After successfully running the script, on the System Logs page (System > Monitor > System Logs), you will see "Info" messages for each configuration change (filter on sl-otelcol-mgmt). You will also see "Major" system log messages whenever connectivity fails for the Skylar endpoint or the OpenTelemetry Collector.

After data streams into the Data Visualization dashboards, and other Skylar AI components, they will populate with data. Please note that this process might take several minutes.

2. If you have run the setup script before, run the following command to enable Skylar AI and make sure that everything is working as expected:

   sudo sl-otelcol-mgmt.py -vv skylar --skylar-all

3. If you need to pause Skylar AI, run the following command:

   sudo sl-otelcol-mgmt.py -vv skylar

   Pausing sets all Skylar AI toggle fields to disabled; restarts the event engine and data pull services to reflect the changed configuration; stops Skylar One managed services such as the Metadata Exporter, Alerts Poller, and sl-otel-mgmt.timer; and stops and disables the sl-otelcol systemd service.

4. To check the status of the installation, run the following command:

   sudo sl-otelcol-mgmt.py -vv status

   You should look for the following messages in the output:

   ---------- checking feature toggles​

   SL_EXPORT_EVENTS = False​

   SL_EXPORT_METRICS = True​

   SL_EXPORT_CONFIG = True

   ---------- checking services

   sl-otelcol is enabled and running​

   ---------- checking connectivity​

   checking: Skylar endpoint is healthy​

   checking: local OTELCOL endpoint is healthy

   If you need to turn off the Skylar AI connection, run the following command:
   
   sudo sl-otelcol-mgmt.py -vv skylar --skip-status-service

5. Go to the previous procedure to specify the organizations you want to use for exporting data to Skylar.

Enabling Skylar AI Event Policies

In addition, the Predictive Alerting and Anomaly Detection components of Skylar Analytics require the "Skylar Analytics Event Policies" PowerPack. This PowerPack collects the Skylar One event policies from the "Skylar - Predictive events" and "Skylar One: Skylar Anomaly Score Event Monitoring" PowerPacks.

Older versions of this PowerPack were named "Skylar Predictive Analysis".

To install the "Skylar Analytics Event Policies" PowerPack:

1. Search for and download the PowerPack from the PowerPacks page on the ScienceLogic Support Site (Skylar One > PowerPacks). Alternatively, you can use the link provided by ScienceLogic, if applicable.
2. In Skylar One, go to the PowerPacks page (System > Manage > PowerPacks), click Actions, and then click Import PowerPack.
3. Browse and select the downloaded PowerPack and click Import.
4. On the next screen, click Install and, when prompted for confirmation, click OK.
5. To confirm that the PowerPack was installed properly by go to the Event Policies page (Events > Event Policies) and type the word "predictive" into the Name search field. You should see a number of "Predictive Alerting" event policies.

For information about how to use these components, see the following chapters:

• Skylar Analytics: Anomaly Detection
• Skylar Analytics: Predictive Alerting

Mapping Skylar One Dynamic Application Object Names to Skylar Columns

When data from Skylar One Dynamic Applications is exported to Skylar AI, the names of collection and presentation objects are automatically converted into clean, standardized column names for the Skylar data lake.

The following rules ensure that all Skylar column names are consistent, machine-friendly, and easy to work with. If you are not sure how a name will be converted, use these common word replacements and clean-up rules as a guide.

The conversion process follows several steps:

1. Standardize Special Characters

• If a letter is followed by a non-word character and an "a", replace it with the letter plus "A".
• For example: ba$ → bA
• This ensures that column names are valid and avoid special symbols.

2. Replace Common Words

   Certain words are automatically shortened to standard abbreviations. Here are the most common ones:

   Original Word	Becomes
   ScienceLogic	SL
   Microsoft	MS
   Server	Svr
   Database	DB
   FileSystem	FS
   Interface	IF
   Resource	Rsrc
   Worker	Wrkr
   Service	Svc
   Relationship	Relnship
   Total	Ttl
   Interval	Ival
   Baseboard	Basebrd
   Num Of	Num
   Distribution	Distro
   Level	Lvl
   Hardware	HW
   Software	SW
   Default	Dflt
   Namespace	Nspc
   Virtual Machine	VM
   Kilobytes	KB
   Megabytes	MB
   Gigabytes	GB
   Terabytes	TB
   Backup	Bkup
   Successful	Good
   Expiration	Expiry
   Manufacturer	Mfgr
   Device	Dvc
   Sockets	Socks
   Command	Cmd
   VMware Open	Open
   Processor	Procssr
   Processes	Procs

3. Shorten Common Technical Terms

   Some longer technical words are shortened to their first few letters. Examples:

• Physical → P
• Utilization → U
• Capacity → C
• Configuration → C
• Discovery → D
• Storage → S
• Limit → L
• Network → N
• Address → Addr

(Only the beginning of the word is kept for these cases.)

4. Clean Up the Name

• Remove all non-alphanumeric characters (like spaces, slashes, parentheses, etc.).
• Replace common terms:

• Average → Avg
• QueueLength → QLen
• slSl → SL
• SL1Skylar → SL1Sky
• Exporter → Exptr
• Receiver → Rcvr

5. Add Unit, if Applicable

• If the original name included a unit, like MB, GB, %, and so on, add it at the end after an underscore.
• Format: columnname_unit
• Example: MemoryUtilization (Gigabytes) → MemU_GB