Alarm rules allow to filter and redirect alarms toward existing plugins.

By example, you could do the following:

• Send all SAP jobs alarms to Bob by email
• Send internal alarms to Redpeaks admin by email
• If non office hours, send system CRITICAL alerts by SMS
• Decrease alert severity for non production systems
• Discard non CRITICAL alerts from JAVA stacks of customer X
• Send all alarms from customer A to ServiceNow plugin
• Send all alarms from customer B to ScienceLogic SL1 plugin

• By default, alarm rules are not active
• All generated alerts are propagated to all active plugins
• Use the activation button to enable alarm rules processing.

Warning:

• If alarm rules are enabled, but no rules are defined, no alerts will be propagated to any plugin.
• You should at least define a rule that will take care of the default propagation of the alerts.

• Created rules will be organized in a table in a predefined order.
• Rules will be processed in the order displayed in the table
• You can move a rule up or down
• Press Add button to create a new rule.
• Set a meaningful name and a description to define your rule

Stop on first match:

• If enabled, the alarm won't be processed by the next rule if it matches current rule filters.
• Useful if you want to restrict or prevent the propagation of some alerts

The configuration of the rule consists of setting following parameters:

• Plugins: Where the alarm will be sent if matches all filters
• Schedule: Define when the rule is active
• Severities: What serverities to handle
• Filter: What alarm parameters are expected
• Action: What is going to be done with the alarm if all filter matches

• Select the list of plugins that will be used to propagate the alert if it matches the rule filters
• Unless the selected action is Reject, each plugin from the list will receive the alarm.

• Define when the rule is active
• You can define a time window within the day, some day of the week or a specific date
• Dates field can remain empty
• By example, you can use this option to send an alert by SMS to the support team during non office hours.

• Define the alarm severities to match
• Process only alarms with a matching severity
• You can by example process only MAJOR and CRITICAL alarms

• Filter will be applied on alarm parameters
• Only the alarms that matches the filter will be processed by the Action
• The filter will apply on one or several components:
  • Group: The group of the system for which the alarm is generated.
  • System SID
  • Stack type: ABAP/JAVA/SYBASE/HANA/BO
  • System tag: The tag associated to the group
  • Module: The module ID of the alarm
  • Alarm tag: The tag associated with the alarm
  • Alarm message: The message itself
  • Alarm count: The number of times the alarm has been triggered since first raised time. Reset to 1 when cleared.
  • Agent: The agent from which the alarm is coming from
• The filter will compare the component value of the alarm with a value, by using following comparators:
  • Equals: Strictly equal to a given value (case insensitive)
  • Matches with: A way to check that value contains at least some part of text (see example below)
  • Different than: Is strictely different than a given value
• The filter will evaluate the rules in the predefined order, using the selected operator
  • AND: All rule must be true
  • OR: At least one rule must be true

• Matches with examples

• Defines how to process the alert if it matches all above filters, including schedules and severities:
  • Process: Simply propagate the alert to the selected plugins
  • Reject: Discards the alert
    • If you want the alarm to be completely rejected, you must enable: Stop on first match
  • Send to: Send the alert to the specified recipient (Needs to be associated with email plugin)
  • Transform: Modifies the content of the alarm

Transform:

• Allows to modify the alarm severity

Transform syntax:

• severity+X : Increase the level of severity by X
• severity-X : Decrease the level of severity by X
• severity=X : Set the level of severity to X

Note: More transform capabilities to come.