Modifying alert propagation settings

Alert propagation characteristics specify how the alert is triggered and canceled. By default, an alert is raised after one monitoring interval during which the triggering conditions are fulfilled. In most cases the default settings will be sufficient, but you can modify them as needed.

You can modify the propagation settings in the Detector settings step of the alert definition wizard.

  1. Click the Propagation settings tab.
  2. Select the propagation characteristics you want to apply to the alert. The following alert propagation options are supported:
    • Raise after n intervals
      This setting specifies the number of intervals that must occur before the alert can be raised.

    • Cancel after n intervals
      After the alert occurs, this option specifies the number of subsequent monitoring intervals for which the alert condition must not be present for the alert to cancel itself. That is, after this many monitoring intervals without an event occurring, it will be assumed that conditions are back to normal. The default value is one interval. This option has to be enabled if you want to receive notification messages after the alert state is over. For more information, see Alert notifications.

    • Abort after n minutes
      The number of minutes after which the alert will expire, regardless of whether the triggering conditions are fulfilled. The default value is 60 minutes.

    • Reissue every n intervals
      Specifies the number of events that must occur following the last notification of the alert before the alert notification is re-issued.

    • Reissue every n minutes
      Specifies the number of minutes that must elapse following the last notification of the alert before the alert notification is re-issued.

    • Delayed processing
      This option affects mainly alert definitions that require normal (baseline or average) values of metrics to be calculated. This means that the alert will become active a predefined time after system startup (default: two days). It can be enabled in situations when the baselines are not yet calculated (for example, during the first 48 hours after you install NAM). See Baseline data. The option should also be enabled if you want to use predefined New objects alerts reporting on new applications, servers, services, users or workstations detected in your network. This will enable NAM to learn which objects belong to your network before raising an alert.

      Note
      • Reissuing and aborting alerts is possible only if you specify when the alert should be canceled first. However, after the canceling of an alert is enabled, aborting will be automatically enabled as well and impossible to disable, whereas re-issuing is optional.
      • When you want your alert to be reissued, you can specify *either * the number of intervals or the number of minutes after which it should be repeated, and not both.

      Some of these options, when selected, allow you to define an annotation, which is additional text to be appended to the alert basic message. An annotation is propagation-specific, which means that the annotation for an alert cancellation can be different from the annotation for an alert re-issue.

    • When no traffic was observed
      This options sets the behavior of the alert system when the observed data contains no qualified traffic.

      The alert conditions are met.
      The alert system will assume that the alert conditions are met and execute the actions specified in the alert definition (send raise notification). The cancel will be sent after the number (defined in the Cancel after setting) of consecutive intervals occur where condition are not met (everything will return to normal).

      Example

      This example represents actions based on the following settings:
      Raise after = 1 Cancel after = 2
      When no traffic was observed : The alert conditions are met The interval containing no relevant data (No traffic) assumes that the alert conditions are met and sends the raise notification. The condition will be met for the duration of the no traffic gap, but the alert system will wait until it observes two consecutive intervals (Cancel after setting) with relevant data that is within norms.

      The alert conditions are not met.
      The alert system will assume that the alert conditions are not met and apply the Cancel after setting to determine how many intervals must pass with the current condition to send the cancel alert.

      Example

      This example represents actions based on the following settings:
      Raise after = 1 Cancel after = 2
      When no traffic was observed : The alert conditions are not met The raise notification is sent because the relevant data in the first interval is outside the norms. In the next interval, no relevant data (No traffic) is observed and, since the "No traffic " setting is set to The alert conditions are not met, based on the alert definition, no notifications are sent. This interval is counted as the first interval for the Cancel after setting. The next interval contains no relevant data and conditions are still not met because of the "No traffic " setting. However, because of the Cancel after setting is set to 2, and this is the second interval with no relevant data (no traffic), cancel notification is sent.

      Perform no action and wait for traffic.
      The alert system will ignore the missing data and wait for relevant data. Once the relevant data is observed, the system will apply its alert definition to each interval.

      Example

      This example represents actions based on the following settings:
      Raise after = 1 Cancel after = 2
      When no traffic was observed : Perform no action and wait for traffic The raise notification is sent because the relevant data is outside the norms. The following two intervals contain no relevant data. Once the relevant data is observed again, the alert system applies the Cancel after setting and sends the cancel notification after observing two consecutive intervals containing relevant data that is within norms (condition is not met).

  3. Proceed to the next wizard step or finish the configuration.
    • To proceed to notification configurations, click Next.
    • To save the configuration, choose Finish.

Example: visual representation of alert propagation settings

The diagrams below show the relationships between the time when alert triggering conditions are met, the moment when an alert is raised and sending an alert notification. The time shown means not the real time of an event, but the time as it is reported in the Alert Log, where the timestamp from the beginning of a given interval is used. For example, if you specify that the alert should be raised after 3 consecutive monitoring intervals, and the triggering conditions are met, the reported timestamp will be that of the beginning of the third interval . This is why on a diagram it may look as if the alert was actually raised after the second interval, and not after the third one.

However, aborting an alert is marked exactly as it happens. For example, if an abort time is set to 15 minutes, it is shown at the beginning of the* fourth* interval.

Figure 1. Alert raised after n intervals..

To ensure that the alert is triggered only when the problem persists in time, you can configure the alert to be sent only after several consecutive intervals (by default, 1) during which the conditions specified in the alert definition are met.

Example setting:

  • Raise after 3 monitoring intervals during which the conditions are fulfilled.
Alarm trigger example
Alarm trigger example

Figure 2. Alert canceled after n intervals..

Specifying when the alert should be canceled means that it is not automatically lowered until the specified number of intervals elapses.

Example settings:

  • Raise after 1 monitoring interval during which the conditions are met.
  • Cancel after 4 monitoring intervals during which the conditions are not fulfilled.
  • Abort after 30 minutes.
Alarm trigger example
Alarm trigger example

Figure 3. Alert aborted after n minutes after the alert was triggered.

You can configure the alert to be aborted even if the triggering conditions are still present.

Example settings:

  • Raise after 1 monitoring interval during which the conditions are met.
  • Cancel after 1 interval during which the conditions are not fulfilled.
  • Abort after 15 minutes.
Alarm trigger example
Alarm trigger example

Figure 4. Alert reissued every n minutes after the alert was triggered.

In this example, an alert is first raised immediately after the trigger conditions appeared, and then reissued every ten minutes.

  • Raise after 1 monitoring interval during which the conditions are met.
  • Cancel after 2 intervals during which the conditions are not fulfilled.
  • Abort after 40 minutes.
  • Reissue every 10 minutes.
Alarm trigger example
Alarm trigger example