Merge pull request #90113 from gabriel-rh/OBSDOCS-1751

OBSDOCS-1751 incident detection ui plugin

Author: gabriel-rh

_topic_maps/_topic_map.yml

@@ -2919,6 +2919,8 @@ Topics:
     Topics:
     - Name: Observability UI plugins overview
       File: observability-ui-plugins-overview
+    - Name: Monitoring UI plugin
+      File: monitoring-ui-plugin
     - Name: Logging UI plugin
       File: logging-ui-plugin
     - Name: Distributed tracing UI plugin

images/coo-incident-alerts-components-expanded.png

@@ -3,7 +3,7 @@
 // * observability/cluster_observability_operator/ui_plugins/distributed-tracing-ui-plugin.adoc
 
 :_mod-docs-content-type: PROCEDURE
-[id="coo-distributed-tracing-ui-plugin-install-_{context}"]
+[id="coo-distributed-tracing-ui-plugin-install_{context}"]
 = Installing the {coo-full} distributed tracing UI plugin
 
 

images/coo-incident-alerts-components.png

@@ -0,0 +1,16 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="coo-incident-detection-overview_{context}"]
+= {coo-full} incident detection overview
+
+Clusters can generate significant volumes of monitoring data, making it hard for you to distinguish critical signals from noise.
+Single incidents can trigger a cascade of alerts, and this results in extended time to detect and resolve issues.
+
+The {coo-full} incident detection feature groups related alerts into *incidents*. These incidents are then visualized as timelines that are color-coded by severity.
+Alerts are mapped to specific components, grouped by severity, helping you to identify root causes by focusing on high impact components first.
+You can then drill down from the incident timelines to individual alerts to determine how to fix the underlying issue.
+
+{coo-full} incident detection transforms the alert storm into clear steps for faster understanding and resolution of the incidents that occur on your clusters.

images/coo-incident-alerts-timeline.png

@@ -0,0 +1,59 @@
+// Module included in the following assemblies:
+
+// * observability/cluster_observability_operator/ui_plugins/incident-detection-ui-plugin.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="coo-incident-detection-using_{context}"]
+= Using {coo-full} incident detection
+
+.Prerequisites
+
+* You have access to the cluster as a user with the `cluster-admin` cluster role.
+* You have logged in to the {product-title} web console.
+* You have installed the {coo-full}.
+* You have installed the {coo-full} monitoring UI plugin with incident detection enabled.
+
+
+.Procedure
+
+. In the Administrator perspective of the web console, click on *Observe* -> *Incidents*.
+
+. The Incidents Timeline UI shows the grouping of alerts into *incidents*. The color coding of the lines in the graph corresponds to the severity of the incident. By default, a seven day timeline is presented.
++
+image::coo-incidents-timeline-weekly.png[Weekly incidents timeline]
++
+[NOTE]
+====
+It will take at least 10 minutes to process the correlations and to see the timeline, after you enable incident detection.
+
+The analysis and grouping into incidents is performed only for alerts that are firing after you have enabled this feature. Alerts that have been resolved before feature enablement are not included.
+====
+
+. Zoom in to a 1-day view by clicking on the drop-down to specify the duration.
++
+image::coo-incidents-timeline-daily.png[Daily incidents timeline]
+
+. By clicking on an incident, you can see the timeline of alerts that are part of that incident, in the Alerts Timeline UI.
++
+image::coo-incident-alerts-timeline.png[Incidents alerts timeline]
+
+. In the list of alerts that follows, alerts are mapped to specific components, which are grouped by severity.
++
+image::coo-incident-alerts-components.png[Incidents alerts components]
+
+. Click to expand a compute component in the list. The underlying alerts related to that component are displayed.
++
+image::coo-incident-alerts-components-expanded.png[Incidents expanded components]
+
+. Click the link for a firing alert, to see detailed information about that alert.
+
+
+
+[NOTE]
+====
+**Known issues**
+
+* Depending on the order of the timeline bars, the tooltip might overlap and hide the underlying bar. You can still click the bar and select the incident or alert.
+
+* The Silence Alert button in the **Incidents** -> **Component** section does not pre-populate the fields and is not usable. As a workaround, you can use the same menu and the Silence Alert button in the **Alerting** section instead.
+====