Alert notifications

Unless you configure notification messages, the information about raised alerts will only be available in the alert logs.

For the alert notifications to be sent, first you need to configure the SMTP server. For more information, see Reporting and alerting on mailer setup.

All NAM alert management starts with the Alert management screen.

Adding and enabling sending notifications for a recipient

  1. Select the recipient type.

    • To have the notification sent to a user e-mail address, define the message in the Message template text box on the notification configuration screen.
    • To have the notification sent to an SNMP trap recipient, you need to specify a separate message on the Trap recipient tab. Due to trap limitations, messages longer than 512 characters will be truncated.
  2. Formulate a message template.
    The template can be composed of generic textual information and fields (metrics, dimensions, and other) selected from the list that is accessed via the Filter syntax guidelines icon. When a notification is sent, each field is mapped to real traffic data. The meaning of the fields is explained beside each field number:

    {0} Alert Name
    {1} Application
    {2} Transaction
    

    For example, to be notified about a high number of Message Queue errors detected for a queue, you could define the following template: The count of Message Queue errors for queue {8} has exceeded the predefined threshold of {19} (metric value: {17}{18}). The total number of operations for this queue was {20}{21}. When received in an e-mail, the message will resemble this example:

    The count of Message Queue errors for queue MQOPEN has extended the predefined threshold of 200 (metric value: 342k).
    The total number of operations for this queue was 533k.
    

    Below the numbered fields, a set of macros is provided for additional specialized processing of the message, for example:

    {getIPAddress{}} Normalize IP address
    {urlHostBase} Report Server Address
    

    Some of the macros are stand-alone while others accept a parameter in the form of a reference to the given field number. Places requiring such a reference are indicated by “{}” brackets.

    {getDate}
    {getDate}
    {getDate}
    

    Notification macros

    {getIPAddress{} - Normalize IP address: accepts a reference to an IP address field in the alarm template, and returns an IPv4 dotted quad.

    {urlHostBase} - Returns the report server URL.

    {encodeURL{}} - Encode the given field in the alarm template, such as a URL, to replace special characters, for example spaces, using %-denoted escape sequences.

    {eTSzdata} - Returns the timestamp of the end of the last monitoring interval for Software service, operation, and site data (zdata). Note that a timestamp is expressed as a number and not as a date/time string.

    {winSup4transdata} - Returns the timestamp of the start of the monitoring interval for Synthetic and sequence transaction data (transdata). Note that a timestamp is expressed as a number and not as a date/time string. This macro works only for ADS.

    {getDate{}} - Translates a reference to a timestamp field to a date and time string.

    {eTStransdata} - Returns the timestamp of the end of the monitoring interval for transdata. (Note that a timestamp is expressed as a number and not as a date/time string.)

    {samplingInterval} - Returns the length of the monitoring interval, expressed in minutes.

    Add report URL Includes a link to a DMI report in the alert notification message.

    1. In the Add report URL window, in the Section list, select the report group.
      If you have more than one report server attached to the RUM Console, you see only the sections that are common for all report servers.
    2. In the Link to report list, select the DMI report whose URL will be included in the notification message.
      You can choose from all saved reports, regardless of the report owner. If you have more than one report server attached to the RUM Console, you see only the reports that are common for all servers.
    3. Select monitored dimensions to be used as report filters.
      The list of monitored dimensions is taken from the Triggering and propagation settings screen. For more information, see Configuring Optional Alert Detector Settings.
    4. Decide whether to use the alert generation time as a report time range. Add external URL Includes a link to an external site in the alert notification message. In the Add an external page URL window:
  3. Optional: Define the message subject for e-mail recipients. The e-mail subject is a key for aggregating alert notifications. Each e-mail has a default subject defined. If you leave the default message subject, you will receive a single notification message about all alerts raised in a single monitoring interval.

    To change the default e-mail subject, type the new subject in the text box. You can use the same macros as in Step 2. This option is available only for CAS 12.3 or later.

    Note

    Notifications with a user-defined message subject are sent separately. Alert aggregation is not available. If you use macros, the notifications will be aggregated for those alerts that have the same parameter values in the message subject (for example, the same application name).

  4. Assign the notification to a selected recipient.

    • From the Actions menu for a given recipient, select Enable notifications. By choosing this option, you leave the notification default settings.
    • From the Actions menu for a given recipient, select Edit notifications, which will open the notification edit screen and enable you to limit sending of notifications to specific conditions. See below.
  5. Optional: Specify when the notifications should be sent. By default, the notification is sent always to the specified recipient, provided the alert conditions are met. However, you can define a set of filters that will limit sending notifications only to specific situations. You can define several filtering criteria in a notification, and all of them have to be met for a message to be sent. To limit sending of notifications to specific conditions:

  6. In the Notification pane, click Add icon Add filter.

  7. Place the mouse pointer over the element list and choose an element (for example, a metric) to which you want to apply the filter.

  8. Define a filter expression. (See 'Filtering on text fields' below.)

  9. Optional: Specify whether you want to receive a single notification message about all alerts raised in a single monitoring interval. This option is available only if your selected recipient is a CAS user. For notifications sent by traps, all messages are always sent separately. It is configured with the Aggregate check box for each device. By default, it is selected. Example of an aggregated message:

    Timestamp: date and time
    
    Realized bandwidth too low
    Affected location: Default
    Normally: 29500 bps
    Currently: 17407 bps
    Affected users: 15
    
    Realized bandwidth too low
    Affected location: MY Location
    Normally: 141208 bps
    Currently: 84205 bps
    Affected users: 9
    
    Realized bandwidth too low
    Affected location: Sienna AS
    Normally: 75412 bps
    Currently: 45104 bps
    Affected users: 3
    

    If you cleared the Aggregate check box, you would receive three separate notifications instead of the above message.

  10. Optional: Add another notification.
    You can have more than one notification in an alert definition. Note that all defined filtering criteria have to be met for at least one notification, and not necessarily for all notifications.

    To add a notification, click Add icon Notification.

  11. Optional: Specify whether you want to receive a notification when the alert state is finished.
    For that purpose, select the Send on alert finish check box. When the alert state is finished, you will receive a notification that reports a current metric value. To change the default behavior and make the alert mechanism report metric value from the moment the alert state started, you need to use Advanced Properties Editor configuration screen on CAS.

    Note that this setting will only work if, in the alert propagation settings, you have specified when the alert should be canceled and aborted. For more information, see Modifying Alert Propagation Settings.

  12. Optional: Enable of disable the notifications for mobile users.
    On the Mobile tab, specify whether you want the mobile users to receive a notification by selecting the Send push notifications check box.

  13. Click OK to save the notifications.

  14. Click Next to review the alert definition summary and to publish the configuration.

At any time, you can disable, enable, or delete the alert notifications for the selected recipients on the Recipients tab of the Alert management screen.

Sending SNMP alert notifications to a single trap manager

When several report servers send notifications to a single trap manager, you must enable unique object identifier (OID) generation, either automatically or manually, or the manager will map trap definitions and instances incorrectly.

To initiate creation of unique trap OIDs on a machine that will send alert notifications:

  1. Locate configuration file commonAlarm-hcbs.properties on a machine that will send alerts. In a default installation, the entire file path is: <installation directory>\config\commonAlarm-hcbs.properties

  2. Add two properties to this file to give you control over the way OIDs are generated.

    MibBuilder.flags = combinesAgent2TrapObjId
    With this setting, OID sub-identifier strings are generated automatically based on the service IP address and port number.

    *MibBuilder.agentId = NON_NEGATIVE_INTEGER With this setting, you define the OID sub-identifier manually, where NON_NEGATIVE_INTEGER is a non-negative integer you specify. Note that you cannot use this property alone; use it in combination with MibBuilder.flags to enable OID generation.

Disabling the alert engine on CAS

To disable the entire alert system, edit the report server configuration file commonAlarm-hcbs.properties .

  1. Open the commonAlarm-hcbs.properties file in a text editor.
    You will find this file on the report server in the *<installation directory>* \config\ directory.
  2. Add the following line to the file:
     CAE_AlarmEngine.doNOTprocessAlarms=true
    

The alert engine (detection and generation mechanisms) will be disabled when you restart the report server and alert notifications will not be sent. To restore the alert engine operation, remove this line or comment it out.