Active
AI Generated
Event-Driven xSOS RCA
Gather facts before you guess a fix
Description
When monitoring or ticketing cannot classify an incident, publish an unknown-issue event to AWS SQS. An EDA rulebook matches the payload and POSTs it to an automation orchestrator webhook. The AO workflow launches xSOS on the reported host, saves the report, and publishes job artifacts for downstream triage.
Why it matters
- Unknown issues are where automation usually breaks down. This pattern gathers facts first instead of guessing a remediation playbook.
- EDA reacts to the event in seconds; xSOS gives SREs structured host context without manual SSH triage.
- set_stats artifacts are ready to chain into automation orchestrator for AI-assisted remediation decisions.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Webhook trigger
Starts a workflow when an external system sends an authenticated HTTP POST to a generated endpoint URL, with the request body available as trigger input for downstream steps. Commonly used to integrate CI/CD pipelines, monitoring tools, or Splunk alerts — each workflow gets its own unique URL path.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
-
Action steps
Script step
Runs Python or Bash to parse, transform, or reshape data between steps — for example, normalizing an API response before a Task agent or AAP job consumes it. Lightweight alternative to launching a playbook; test with mock upstream output in the builder before publishing. Disabled by default until execution-plane capabilities are available in your deployment — intended for demos and early evaluation today. Additional scripting languages may be supported later based on demand.
Interactive Experience
Planned scope
- One-time SQS queue setup and a publish playbook to simulate unknown-issue alerts
- EDA rulebook with AWS SQS source and conditional launch of the xSOS analysis job template
- xSOS install, run, and report save on the affected RHEL host
- Job artifacts (issue context, report path, preview) for downstream AO or MCP workflows
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "Unknown issue event", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/script-node.png", label: "AWS SQS queue", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/script-node.png", label: "EDA rulebook", pos: "b", h: 96, constraint: "on" }
C --> D@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "AO webhook trigger", pos: "b", h: 96, constraint: "on" }
D --> E@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run xSOS analysis", pos: "b", h: 96, constraint: "on" }
E --> F@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/script-node.png", label: "RCA report + artifacts", pos: "b", h: 96, constraint: "on" }
F --> G@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "Operator or AI next step", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D,E,F,G noBorder
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
setup_sqs_queue.yml
|
Creates the AWS SQS queue for unknown-issue RCA events (one-time per account/region). | localhost (AWS API) |
publish_unknown_issue_event.yml
|
Publishes a demo unknown-issue JSON payload to SQS to simulate an alert integration. | localhost (AWS CLI) |
post_ao_webhook.yml
|
POSTs the SQS event payload to the automation orchestrator EDA webhook (launched by the EDA rulebook). | localhost |
run_xsos_analysis.yml
|
Installs xSOS if needed, runs analysis on the target host, saves the report, and publishes RCA artifacts. | RHEL target host (EDA or manual) |
Demo ideas
- Publish a demo event and walk through EDA firing the analysis job within seconds
- Show the xSOS report on the target host and the set_stats artifacts in the job output
- Discuss chaining artifacts to an automation orchestrator Task Agent for remediation routing
AI Generated
This demo's playbooks and workflow were generated by AI to illustrate the pattern. They have not been fully tested in a live environment. Review and adapt before using in production.