Alarm generation conditions

Both alarm generation conditions and State change conditions can generate Incidents.

While these conditions look similar, they have essential differences.

With generating alarms, manually created levels are available as well as the four default levels:

ALARM

MAJOR

WARNING

CLEARED

The functionality of alarm creation based on Alarm generation conditions is optional and disabled by default. To enable it the following parameters must be added or modified:

Each record consists of:

  1. Condition:

    • data source is the metric name from the Data table of the current object;

    • comparison operator from the dropdown list, for instance, = or matches;

    • value to compare with.

  2. Action - transition the state to the selected one when the condition is met.

Mathematical comparison operators are used for numeric values; textual operators are used for numeric and text values, case-insensitive.

The operators = and ≠ can also be used with text values, case-sensitive.

It is possible to use regular expressions with textual comparison operators such as matches.
image

Conditions priority

If Alarm generation conditions are not defined, alarms are generated for objects in states with set alarm severity. By default these are the following states:

ALARM,

OVERLOADED,

DOWN,

NO DATA.

The presence of Alarm generation conditions disables alarm generation by State change conditions, but does not disable defined states changing rules.

One or several alarms

An object can be in one state at a time, so:

  • State change conditions create only one alarm for one object at a time;

  • Alarm generation conditions allow to create several alarms for one object.

For example, there is an object to check temperature (T) and humidity (H).

The following State change conditions are set:

  • if T > 30, then change the state to the ALARM one;

  • if H > 50, then change the state to the OVERLOAD one;

  • else change the state to the WORKING one.

The data T = 31, H = 51 come from the object.

In this case:

  • the object will be transferred to the ALARM state;

  • an alarm with ALARM level will be generated for the ALARM state.

Then the following Alarm generation conditions are added:

  • if T > 30, then generate an alarm of ALARM level;

  • if H > 50, then generate an alarm of WARNING level.

The data T = 31, H = 51 come from the object once again.

In this case:

  • the object will be transferred to the ALARM state;

  • two alarms with ALARM and WARNING levels will be created.

Additional clear conditions

An alarm, created with met alarm generation conditions, is automatically cleared when the conditions of its generation are no longer met.

With the button image additional conditions can be added. These conditions must be met as well in order to automatically clear the alarm:

image

Actions on state changes

The functionality Actions on state changes depends on State change conditions only.

Presence or absence of Alarm generation conditions does not affect on State change conditions and actions on state changes.

Synthetic alarms

Synthetic alarm is an alarm, generated by one or several regular alarms embedded in it.

image

If several synthetic alarms are specified for one object, then the lower it is in the list of alarms, the higher priority it has.

There are the rules regarding the mechanism of synthetic alarms generation:

  • an individual alarm is generated for each object;

  • after receiving the clearing message, the alarm is colored green with the status CLEARED and:

    • if a similar alarm occurs before N (configurable threshold time) minutes, then the alarm resumes;

    • if a similar alarm occurs after N minutes, then a new alarm is created;

  • the transition from the list of active alarms to the list of historical alarms occurs in M minutes after receiving a clearing message (M is configurable time during which the alarm remains in the list of active alarms after its completing);

  • the time of displaying a completed alarm in the active list should be greater than or equal to the threshold time: M is greater than or equal to N;

  • a synthetic alarm closes after closing of all its nested alarms.

If it is necessary to generate the same synthetic alarm for several objects, the window Search and bulk operations can be useful:

image

Synthetic alarm can be formed on the basic of two or more synthetic alarms, generating the double level of nesting.

image