Introduction to Skylar Analytics

Skylar Analytics includes the following components:

• Data Visualization. Enables SQL-based dashboards and charts based on data gathered by Skylar AI and SL1. Data Visualization is achieved using a ScienceLogic-hosted instance of Apache Superset.
• Data Exploration. Enables third-party tools that use the Open Database Connectivity (ODBC) interface to access the metric data from Skylar AI. This component lets you use ODBC to connect Skylar AI data with applications like Tableau, Microsoft Power BI, or other business intelligence tools.
• Anomaly Detection. Uses always-on anomaly detection to find metric outliers in Dynamic Application time series data. It also computes an anomaly score that characterizes the significance of each anomaly. You can view anomalies for all Dynamic Application metrics for a device by visiting the Anomaly Detection tab on the Device Investigator page for that device.
• Predictive Alerting. Helps to avoid problems such as file systems running out of space, hosts running out of memory, or issues with network reliability due to oversubscription. The alerts appear as enriched events within SL1.

For an overview of Skylar AI, see Getting Started with Skylar AI.

This video provides an overview of the different features of Skylar Analytics: https://player.vimeo.com/video/990317575?h=74e1aca2bf

To view the latest Skylar Analytics release notes, see the Skylar Analytics Release Notes.

What is Skylar Analytics?

The Skylar Analytics suite of services uses data gathered by SL1 to explore data, generate visualizations, and monitor IT infrastructure metrics. Skylar Analytics can also use Skylar AI to predict alerts before they happen, and detect anomalies that could become events that might disrupt your IT infrastructure and functionality.

SL1 uses port 443 to communicate with your Skylar Analytics system. Skylar AI does not require a port.

Skylar Analytics includes the following components:

• Data Visualization. Enables SQL-based dashboards and charts based on data gathered by Skylar AI and SL1. Data Visualization is achieved using a ScienceLogic-hosted instance of Apache Superset.
• Data Exploration. Enables third-party tools that use the Open Database Connectivity (ODBC) interface to access the metric data from Skylar AI. This component lets you use ODBC to connect Skylar AI data with applications like Tableau, Microsoft Power BI, or other business intelligence tools.
• Anomaly Detection. Uses always-on anomaly detection to find metric outliers in Dynamic Application time series data. It also computes an anomaly score that characterizes the significance of each anomaly. You can view anomalies for all Dynamic Application metrics for a device by visiting the Anomaly Detection tab on the Device Investigator page for that device.
• Predictive Alerting. Helps to avoid problems such as file systems running out of space, hosts running out of memory, or issues with network reliability due to oversubscription. The alerts appear as enriched events within SL1.

The other chapters in this manual cover each Skylar Analytics component in detail.

Getting Started with Skylar Analytics

These instructions are only for on-premises configurations of Skylar AI. The ScienceLogic SRE team performs these steps for SaaS configurations of Skylar AI.

Before you can start using Skylar Analytics, you will need to perform the following configurations in SL1 to enable the export of data from SL1 to Skylar:

• Create a Service Connection
• Enable Skylar Analytics for one or more organizations

After you perform these configurations, you can access Skylar Analytics and other key Skylar AI components from the Skylar AI page () in SL1.

For information about setting up users, user groups, and user roles, see Configuring Skylar AI System Settings.

ScienceLogic strongly recommends that you always use the most recent SL1 and AP2 releases in conjunction with the most recent Skylar AI release. Using the most recent releases will ensure that your Skylar AI system has access to the latest datasets and features. For more information, see the SL1 Platform and AP2 Release Notes.

Creating a Service Connection

If you are using AP2 Mochi or later with your SL1 system, you can create a service connection for the Skylar AI engine on the Service Connections page (Manage > Service Connections) in SL1. ScienceLogic strongly recommends that you upgrade to Mochi or later. For more information, see the AP2 Mochi release notes.

The service connection enables communication between your SL1 system and Skylar AI. This process replaces the Running the Skylar SL1 Management Tool process in previous releases of Skylar Analytics and SL1.

To create a Skylar AI Engine service connection:

1. In SL1, go to the Service Connections page (Manage > Service Connections).

2. Click Add Service Connection and select Skylar AI Engine. The Create Skylar AI Engine Credential window appears.

3. Complete the following fields:
   

• Name. Type a name for the new service connection.
• API Key. Add the access token for Skylar AI, which you can generate on the Access Tokens page in Skylar Settings (Instances > Access Tokens). For more information, see Creating Access Tokens for Users.
• Skylar AI Engine URL. Add the URL for your Skylar AI system.

4. Click Save. The service connection is added to the Service Connections page, and a modal displays a link to the Organizations page, where you can enable Skylar Analytics for one or more organizations. See the following procedure for more information.

5. Refresh or reload the browser to add all updates to SL1.

   Newer releases of SL1 include a Status and Status Updated column, along with a Service Check column that displays a Run Test button for "Skylar AI Engine" service connection types. Click Run Test to run a script to check the status of the Skylar AI connection and display the results in a modal.

Enabling Skylar AI for One or More Organizations

You will need to select one or more organizations in SL1 that will share data with Skylar AI. This data will come from all of the devices in a selected organization. By default, the Skylar AI features are disabled.

You can see which organizations are currently sending data to Skylar AI by going to the Organizations page (Registry > Accounts > Organizations) and looking at the Skylar AI Status column for the organizations.

To enable Skylar AI with SL1 organizations:

1. In SL1, go to the Organizations page (Registry > Accounts > Organizations) and click the check box for one or more organizations.
2. In the Select Action drop-down, select Send Data from Selected Orgs to Skylar AI and click Go to start sending data about the selected organizations to Skylar AI. The Skylar AI Status column for the selected organizations changes to Enabled.

For Older Versions: Running the Skylar SL1 Management Tool

If you are using a version of AP2 before Mochi, you will need to set up Skylar AI with the steps below for the Skylar SL1 Management Tool instead of the Service Connections page in SL1. ScienceLogic strongly recommends that you upgrade to Mochi. For more information, see the AP2 Mochi release notes.

The Skylar SL1 Management Tool configures SL1 data and SL1 processes, and it starts monitoring the Skylar connection and configuration. The script is named sl-otelcol-mgmt.py, and it is included in the sl-otelcol RPM package.

To run the Skylar SL1 Management Tool:

6. Use the following command to run the Management script on the Database Server (an SL1 Central Database or an SL1 Data Engine):

   sudo sl-otelcol-mgmt.py -vv skylar --skylar-all --skylar-endpoint "<URL_for_skylar_system>" --skylar-api-key "<skylar-access-token>" --ap2-feature-flags

   where:

   • <URL_for_skylar_system> is the URL for your Skylar AI system
   • <skylar-access-token> is the access token for Skylar AI, which you can generate on the Access Tokens tab of the Skylar Settings page. For more information, see Creating Access Tokens for Users.

   You can also use the following configuration options if needed:

   • --verify-cert false. Allows users in on-premises environments to connect to Skylar AI using self-signed certificates.
   • --ca-bundle /<path>/bundle.pem. Allows users to specify a path to a .pem file and assign it to the REQUESTS_CA_BUNDLE environment variable.
   • --skylar-disable. Stops all Skylar AI exports and services. This flag performs the same operations as the pause command (see step 3, below) and also removes any Skylar AI pages from the SL1 user interface.

   If you have already run setup before and are not changing the connection details, you do not need to include --skylar-endpoint "<URL_for_skylar_system>" --skylar-api-key "<skylar-access-token>".
   
   In addition, --ap2-feature-flags is only needed the first time you install Skylar AI.

   This command configures the OpenTelemetry Collector, restarts services that export data, and checks that connectivity to the supplied endpoints is healthy.

   After successfully running the script, on the System Logs page (System > Monitor > System Logs), you will see "Info" messages for each configuration change (filter on sl-otelcol-mgmt). You will also see "Major" system log messages whenever connectivity fails for the Skylar endpoint or the OpenTelemetry Collector.

   After data streams into the Data Visualization dashboards, and other Skylar AI components, they will populate with data. Please note that this process might take several minutes.

7. If you have run the setup script before, run the following command to enable Skylar AI and make sure that everything is working as expected:

   sudo sl-otelcol-mgmt.py -vv skylar --skylar-all

   To check to make sure you have connected Skylar AI to SL1, go to SL1 and look for the Skylar AI page (). If the page loads, then the connection was successful. You can also go to the Service Connections page (Manage > Service Connections) and look for a service connection with a Type of "Skylar AI Engine" to verify that the connection was successful. After a few minutes, the Data Visualization charts will populate with data if the connection was successful.

8. If you need to pause Skylar AI, run the following command:

   sudo sl-otelcol-mgmt.py -vv skylar

   Pausing sets all Skylar AI toggle fields to disabled; restarts the event engine and data pull services to reflect the changed configuration; stops SL1 managed services such as the Metadata Exporter, Alerts Poller, and sl-otel-mgmt.timer; and stops and disables the sl-otelcol systemd service.

9. To check the status of the installation, run the following command:

   sudo sl-otelcol-mgmt.py -vv status

   You should look for the following messages in the output:

   ---------- checking feature toggles​

   SL_EXPORT_EVENTS = False​

   SL_EXPORT_METRICS = True​

   SL_EXPORT_CONFIG = True

   ---------- checking services

   sl-otelcol is enabled and running​

   ---------- checking connectivity​

   checking: Skylar endpoint is healthy​

   checking: local OTELCOL endpoint is healthy

   If you need to turn off the Skylar AI connection, run the following command:
   
   sudo sl-otelcol-mgmt.py -vv skylar --skip-status-service

10. Continue to the next procedure to specify the organizations you want to use for exporting data to Skylar.

Enabling Skylar AI Event Policies

In addition, the Predictive Alerting and Anomaly Detection components of Skylar Analytics require the "Skylar Analytics Event Policies" PowerPack. This PowerPack collects the SL1 event policies from the "Skylar - Predictive events" and "SL1: Skylar Anomaly Score Event Monitoring" PowerPacks.

Older versions of this PowerPack were named "Skylar Predictive Analysis".

To install the "Skylar Analytics Event Policies" PowerPack:

1. Download the PowerPack from the ScienceLogic Support Site, or use the link provided by ScienceLogic.
2. In SL1, go to the PowerPacks page (System > Manage > PowerPacks), click Actions, and then click Import PowerPack.
3. Browse and select the downloaded PowerPack and click Import.
4. On the next screen, click Install and, when prompted for confirmation, click OK.
5. To confirm that the PowerPack was installed properly by go to the Event Policies page (Events > Event Policies) and type the word "predictive" into the Name search field. You should see a number of "Predictive Alerting" event policies.

For information about how to use these components, see the following chapters:

• Skylar Analytics: Anomaly Detection
• Skylar Analytics: Predictive Alerting

Mapping SL1 Dynamic Application Object Names to Skylar Columns

When data from SL1 Dynamic Applications is exported to Skylar AI, the names of collection and presentation objects are automatically converted into clean, standardized column names for the Skylar data lake.

The following rules ensure that all Skylar column names are consistent, machine-friendly, and easy to work with. If you are not sure how a name will be converted, use these common word replacements and clean-up rules as a guide.

The conversion process follows several steps:

1. Standardize Special Characters

• If a letter is followed by a non-word character and an "a", replace it with the letter plus "A".
• For example: ba$ → bA
• This ensures that column names are valid and avoid special symbols.

2. Replace Common Words

   Certain words are automatically shortened to standard abbreviations. Here are the most common ones:

   Original Word	Becomes
   ScienceLogic	SL
   Microsoft	MS
   Server	Svr
   Database	DB
   FileSystem	FS
   Interface	IF
   Resource	Rsrc
   Worker	Wrkr
   Service	Svc
   Relationship	Relnship
   Total	Ttl
   Interval	Ival
   Baseboard	Basebrd
   Num Of	Num
   Distribution	Distro
   Level	Lvl
   Hardware	HW
   Software	SW
   Default	Dflt
   Namespace	Nspc
   Virtual Machine	VM
   Kilobytes	KB
   Megabytes	MB
   Gigabytes	GB
   Terabytes	TB
   Backup	Bkup
   Successful	Good
   Expiration	Expiry
   Manufacturer	Mfgr
   Device	Dvc
   Sockets	Socks
   Command	Cmd
   VMware Open	Open
   Processor	Procssr
   Processes	Procs

3. Shorten Common Technical Terms

   Some longer technical words are shortened to their first few letters. Examples:

• Physical → P
• Utilization → U
• Capacity → C
• Configuration → C
• Discovery → D
• Storage → S
• Limit → L
• Network → N
• Address → Addr

(Only the beginning of the word is kept for these cases.)

4. Clean Up the Name

• Remove all non-alphanumeric characters (like spaces, slashes, parentheses, etc.).
• Replace common terms:

• Average → Avg
• QueueLength → QLen
• slSl → SL
• SL1Skylar → SL1Sky
• Exporter → Exptr
• Receiver → Rcvr

5. Add Unit, if Applicable

• If the original name included a unit, like MB, GB, %, and so on, add it at the end after an underscore.
• Format: columnname_unit
• Example: MemoryUtilization (Gigabytes) → MemU_GB