Events and Alerting

By far the most questions we receive are about alerting! Most questions are like, “why didn’t I get an alert when my server went down” or “I didn’t get alerted when my server drive ran out of free disc space”.

Usually, the short answer to these questions is that, according to the Monitor one “Alert table”, the event was simply not important enough (didn’t exceed the Alerting threshold) to generate an alert!

The long answer needs more words...

In large networks, possibly a large number of events occur. In general, network managers only want to be alerted about major network events such as a power failure in a backbone switch or a crash of the corporate mail-server. A non-functioning printer is simply less important and can wait - especially when alerting is performed via a pager or mobile phone during the weekends. The Monitor one alerting facility called the “Alerter” allows you to define when and how to alert.

How does the Monitor one alerter determine whether an alert must be generated for an event or not?

Imagine that you have a server in your network that you want to monitor for uptime by polling it every 10 seconds. You have created a Class named: “LinuxServers” with a “Class Priority Level” (CPL) of 7 and you have added a device object (representing the server) to the network map named: “LinuxServer01”.

The Alert-table can be viewed by selecting Options|Global configuration from the menu on the main window and than clicking the “Alerting” tab. A screenshot of the table is shown below:

When after a couple of months the server “LinuxServer01” experiences problems and crashes – (purely hypothetical of course, Linux servers never crash ;-), Monitor one raises a “No response from device” event, writes a message to the Monitor one logbook and calls the “Alerter”. The Alerter now takes the CPL of the “LinuxServers” class (=7), multiplies it with the “Event Priority Level” (EPL) (=8) and compares the result with the “Alerting threshold” (AT) (=64). The result (56) is less than the AT and therefore no alert is generated!

There are now two possibilities; you increment either the CPL OR the EPL. The first is the recommended way. Setting the CPL to 9 does the job. Incrementing the EVP is not recommended because it affects the whole table!

The CPL can be adjusted by right-clicking the appropriate entry in the table and either choosing “Increment..” or “Decrement..”. Of course you can also modify the CPL setting on the “Add/Modify a class page”.