26.1 Events

Advisors generate events if one, or more, of the defined thresholds are crossed by the monitored value.

Events are displayed on the Events view. Emergency and Critical events also appear on the Overview dashboard. The notification group or groups associated with a specific advisor receive a notification when an alert is triggered. For more information about creating notification groups, see Chapter 22, Event Handlers.

To view open events, select Events from the navigation bar. The target selection menus enable you to choose which group's or asset's events are displayed.

Important

The events displayed are dependent on the permission of the role to which you are assigned. If you are a member of a group-specific role, the events displayed are generated by the members of that group, only. Your ability to close events is also governed by the permissions of your role.

For more information, see Chapter 23, Access Control.

The following image shows the Events page with filter enabled:

Figure 26.1 Events Page with Filter

Note

You can change the column selection using the Show/Hide Columns button, adjacent to the filter drop-down list.

Event Filter

The Event filter enables you to filter your events based on criteria.

Table 26.1 Events Filter Controls

Name	Description
Time Range	Enables you to choose a time range. Possible values are: All Time: filter on all events. Interval: displays the Interval drop-down list, enabling you to filter on a defined range from the current time. For example, if you select 15 minutes, the filter returns events generated in the last 15 minutes, only. From/To: displays From and To fields enabling you to define a date and time range to filter on.
State:	Enables you to choose the events states to filter on. The available choices are Any, Open, or Closed.
Current Status	Enables you to filter on specific current status.
Worst Status	Enables you to filter on specific worst status.
Advisors	Enables you to filter events based on the Advisors which generated them.
Filter	Click to filter the events list on the defined criteria.
Discard changes	Removes any changes made.
Reset to Default	Reverts any changes, and restores the saved criteria.

Events List

The Events list displays all events for the selected group or asset.

Table 26.2 Events List Columns

Name	Description
Multi-select checkbox	Enables you to select all events.
Current	Displays an icon indicating the current status of the event.
Worst	Displays an icon indicating the worst status of the event.
Subject	Displays the hostname and location of the problem. For example, if the issue is low disk space on a monitored host, the Subject displays the hostname and the path to the drive which is running out of space. If the issue is related to an instance running on that host, the hostname, and the name and port number of the instance are displayed.
Topic	Displays the short description of the event.
Time	Displays the approximate time the event was generated.
Actions	Displays the possible actions. Click X to open the Close Events dialog.

• Emergency: The event is an emergency and requires immediate attention.

• Critical: The event is critical and requires immediate attention. Critical events indicate that a serious problem has occurred or is about to occur.

• Warning: The event is something to investigate and schedule for correction, but does not immediately affect the operation of your server, such as free space on a disk, or a table cache is inadequately sized.

• Notice: The event is for informational purposes. Notice events call attention to issues that do not affect the operation of your server, such as minor configuration issue.

• Success: The rule executed successfully with no issues. It also indicates an event, previously in a Critical or Failure state, has returned to normal.

• Unknown: The current status of the event/rule cannot be determined.

• Closed: The issue has been corrected and marked closed.

Table 26.3 Event State Icons

Icon	Description
	Red and orange flame icon indicates an emergency alert.
	Round red icon indicates a critical alert.
	Triangular yellow icon indicates a warning.
	Blue octagon with the letter "i" indicates an informational alert.
	Green check indicates that the Advisor ran successfully and no alert was generated.
	Skull icon indicates that the status of the Advisor is unknown.

Closing Events

Advisor's generate events when the threshold defined on the Advisor is breached. Investigate the issue that triggered the event; rectify the issue or problem (or choose to ignore it); then close the event when you are satisfied it does not have a significant impact on your servers.

Some of the advisors identify transient or temporary issues, such as a replication slave being unavailable. For these advisors, you can schedule events to automatically be closed when the event moves from notification status back to the OK state.

When auto-close is enabled, the event remains open while the condition that triggered the event is still in effect. When the condition is no longer in effect, the event is automatically closed. You can also manually close such events before resolving the issue. Events can also be closed by event handlers. For more information on handling events, see Chapter 22, Event Handlers.

Important

Not all Advisors generate events which can be auto-closed. See Chapter 20, Expression-Based Advisor Reference and Chapter 21, GUI-Based Advisor Reference for more information on the Advisors which support auto-close.

Events which support auto-close are closed by the Default Auto-close Policy after the event which triggered them is no longer in effect. For more information on Default Auto-close Policy, see Default Auto-close Policy. It is possible to override the Default Auto-close Policy by setting Auto-Close Events to No in an Event Handler

To close an individual event, click the [X] icon in the Actions column. Document the resolution using the Notes text area and choose the Close Events button. During the closing operation, you can also reconfigure the rule scheduling that triggered this event by selecting the checkbox After closing, take me to the page for adjusting schedules of Advisor(s) that reported these events. This option opens the Advisors page and selects the relevant Advisors.

For more information on configuring advisor scheduling and auto closing, see Table 19.3, “Advisor Edit Menu Controls”.

To close a number of alerts simultaneously, select the checkbox beside each event to close and click the Close Selected Events button.

When closing individual or multiple events, a notification window indicates what operations have been completed. The events remain in the displayed event list, but the close link is replaced by a link to the resolution notes. You can update the active list by clicking filter to re-filter the event display.

A historical list of all events, including closed events, is available by setting the Current Severity to Closed. The list shows all of the closed events for a given time range and the servers selected in the server tree. Historical data is limited by the data purge settings. For more information, see Section 15.4, “Data Purge Behavior”

Automatic Closing of Events

If a custom advisor is deleted, or one of the default advisors is made redundant and removed as part of an upgrade, their events can be orphaned. The system automatically closes events which have no advisor linked to them. A note is added to the event stating why it was closed.

Auto-closed events send a notification only if notifications were sent for any previous state transitions. If no other notifications were sent, no notification is sent for the auto-close.