Alarm Policies

eG Enterprise includes four predefined alarm policies indicated in Figure 1. These alarm policies are used by the system to determine when to generate alarms. For instance there might be an instantaneous surge in the CPU utilization of a system. While an instantaneous surge may not be a problem, a set of periodic surges or a persistent increase in the measurement may indicate a problem. To differentiate between these different scenarios, eG Enterprise uses two parameters Window size and Number of crossings. The Window size represents the number of measurement values that are considered in determining the current state of a measurement. A crossing indicates a measurement being in violation of its threshold (i.e. a measurement value being lower than its lower threshold value, or a measurement value being higher than its upper threshold value). The Number of crossings denotes the number of times a measurement has crossed its threshold. Each of eG’s alarm policies defines a window size and number of crossings. For example, an immediate policy has a Window size of 1 and Number of crossings. This means only one measurement value is considered in determining the state of a measurement. If the current value exceeds the upper threshold limit, the measurement is said to be in an abnormal state (since number of crossings is 1).

As its name indicates, this policy is ideal for cases where the administrator needs to be immediately alerted when an anomaly occurs. Metrics such as network / application availability can be monitored using this policy.  For some other metrics, an administrator may not wish to be bothered about a sporadic threshold violation and may prefer to be alerted if a problem remains for a period of time. The standard alarm policy can be ideal for this, as it has a window size of 6, with number of crossings as 4.

You can modify any of the pre-configured policies or define custom policies using the eG admin interface. For this, select the Alarm Policies option from the Alerts tile. This will open Figure 1, which will be split into two distinct panels. The Pre-defined alarm policy panel will display all the default alarm policies. The User defined alarm policy panel will display all custom alarm policies.

alarmpolicy1

Figure 1 : Predefined alarm policies of eG Enterprise

By default, the pre-defined alarm policies will be arranged in the Ascending order of their window sizes. You can change the sort order to Descending, by simply clicking on the column head, Window Size, in the Pre-defined alarm policy panel. You can even sort the contents of the Pre-defined alarm policy panel in the ascending/descending order of any of the other columns displayed therein, by just clicking on the corresponding column head.

You can modify any of the default policies by clicking on the modifygroup button corresponding to that policy, but you cannot delete the default policies.

modifyalarmpolicy

Figure 2 : Modifying an existing alarm policy of eG Enterprise

To help you understand the Window size and Number of crossings concepts better, Figure 3 explains them with the help of an illustration.

Figure 3 : Graphical explanation of the concepts of Window size and Number of crossings

New policies can be added using the Add New Policy button in the User defined alarm policy panel of Figure 1. Figure 4 shows the details to be specified for the new alarm policy. Once you define your own policies, then those will also be listed in the Agents - Alarm Policies page under the User defined alarm policy section depicted by Figure 4.

alarmpolicy2

Figure 4 : Adding a new alarm policy through the user interface

alarmpolicy3

Figure 5 : List of default and user-defined policies

Unlike default policies, a user-defined policy can be modified and/or deleted. Deleting an existing policy is possible using the deletegroup button corresponding to a User defined alarm policy in Figure 5.

Until a newly added policy is associated with a measure, the showassociates icon (the Show Associates icon) corresponding to that policy (in the User defined alarm policy panel) will be disabled. As soon as the policy is associated with a measure, this icon will become enabled. You can click on this icon to view the measures that are currently associated with the corresponding policy (see Figure 6).

alarmpolicy5

Figure 6 : Viewing the measures associated with an alarm policy

This information is typically useful when attempting to determine which measures will be impacted when modifying an alarm policy.

Note that alarm policies that are assigned to one/more measures cannot be deleted.

To quickly locate a default policy for modifying, provide the whole/part of the alarm policy name to search for in the Search text box in the Pre-defined alarm policy panel, and click the ‘magnifying glass’ icon next to it. To quickly locate a user-defined policy for modifying/deleting, provide the whole/part of the alarm policy name to search for in the Search text box in the User defined alarm policy panel, and click the ‘magnifying glass’ icon next to it.