Create and Edit Policies

Schedule

The alert engine runs every three minutes to retest all policies. The Schedule pop-up enables you to define specific time spans for when you want to enable or disable the alert engine to test the policy. If you do not define a schedule, the alert engine tests the policy every three minutes until you disable the policy.

The Periodic tab enables you to define a regularly occurring time span to either enable or disable the policy.

1. Select one of the following options.

   • Select Disable During This Time to disable the policy for the days and/or times you define on the Periodic tab.

   • Select Enable During This Time to enable the policy for the days and/or times you define on the Periodic tab.

2. Select the check box next to each day for the policy to be enabled/disabled (dependent on the option you select in the previous step).

3. In the Start Time fields, enter the start time.

4. In the End Time fields, enter the end time.

5. Click the Time Zone drop-down and select a time zone.

6. Click Add to add the periodic schedule to the list of schedules.

7. Repeat the steps on the Periodic tab to add additional schedules. Schedules are checked in the sequence in which they appear in the list and the first applicable schedule is applied to the policy. If no schedule is applicable, the policy is enabled by default.

The Schedule tab enables you to schedule a specific time span to either enable or disable the policy.

1. Select one of the following options.

   • Select Disable During This Time to disable the policy for the time span you define on the Schedule tab.

   • Select Enable During This Time to enable the policy for the time span you define on the Schedule tab.

2. Click in the Start Date field to display a calendar. Use the calendar to select the date to start the time span to enable/disable the policy (dependent on the option you select in the previous step).

3. Enter the start time.

4. Click in the End Date field to display a calendar. Use the calendar to select the date to end the time span to enable/disable the policy.

5. Enter the end time.

6. Click the Time Zone drop-down and select a time zone.

7. Click Add to add the schedule to the list of schedules.

8. Repeat the steps on the Schedule tab to add additional schedules to the list. Schedules are checked in the sequence in which they appear in the list and the first applicable schedule is applied to the policy. If no schedule is applicable, the policy is enabled by default.

9. Click Close to save the schedule settings.

Email

The Email pop-up enables you to define who should receive emails when the policy triggers an alert. You can email policy alerts to valid email addresses and to the users and user roles you define in SevOne NMS. There is no limit to the number of email recipients.

Perform the following steps in the Addresses section.

1. In the left Addresses field, enter the email address for a recipient.

2. Move the address to the right Addresses field.

3. Repeat the previous steps to add additional email addresses. Email addresses that appear in the right field receive an email when the policy triggers an alert.

Perform the following steps in the Users section.

1. In the left Users field, select the user to receive alert emails (use the Ctrl or Shift keys to multi-select).

2. Move the users you select to the right Users field. Users that appear in the right Users field receive an email when the policy triggers an alert.

Click the Roles drop-down and select the check box for each user role whose members are to receive an email when the policy triggers an alert.

Select one of the following options.

• Select Just Once to only send one email when the policy triggers the first occurrence of an alert. All subsequent occurrences (until the alert is cleared) are not emailed. This prevents an email from being sent every three minutes when a device is down.

• Select One Time Every, enter a number in the text field, then click the drop-down and select minutes, hours, or days to send multiple emails when the policy triggers alerts.

Click Close to save the email settings.

Technology Type - Flow Conditions

For Technology Type Flow policies, perform the following steps to create a trigger condition or a clear condition.

1. Click the Fields drop-down and select a field

2. Click the Aggregation drop-down and select a data aggregation option.

3. Click the Comparison drop-down and select a comparison operator.

4. In the Value field, enter the value to trigger/clear the condition. Click the corresponding drop-down and select the unit of measure.

5. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General tab. Custom message variables are not available for Flow policies.

6. Click Save to save the condition.

Technology Type - Metric Conditions

For Technology Type Metric policies, there are three types of conditions.

• Static conditions compare the current value of an indicator with the value you define.

• Baseline conditions compare the current value of an indicator with the indicator's baseline value. There are three types of baseline conditions.

• Slope conditions calculate the most recent six data points (minimum of four valid points) and compares that value to the threshold you define for the condition. Slope conditions looks for variation of a value from the values that came before to measure the relative consistency. This detects a significant change in behavior over a short time.

Static Conditions

Static conditions compare the current value of an indicator with the value you define.

Examples:

• Inbound traffic is greater than 50Mb/s

• Idle CPU time is less than 10%

Perform the following steps to define a Static condition.

1. Click the Indicator drop-down and select the indicator on which to base the condition.

2. Click the Type drop-down and select Static to compare the actual current indicator value to the policy indicator value you define.

3. Click the Comparison drop-down and select a comparison operator. Most comparison operators are self explanatory.
   Select Bad Polls to trigger or clear an alert when a poll attempt either receives nothing or receives invalid data. This creates a time stamp entry and an entry in the data column that represents an unsuccessful poll. This drives the SNMP Availability metric of how many unsuccessful poll attempts were made in a given cycle versus how many poll attempts were successful.

4. In the Threshold field, enter the value at which to trigger/clear the condition then click the Threshold drop-down and select the value unit of measure.

5. The Duration field has two scenarios, a smoothing time duration or a detection time duration.

   • If you select Greater Than, Less Than, Equal To, Greater Than Equal To, Less Than Equal To, or Not Equal To in the Comparison field, enter the number of minutes for which the condition is to be met before the condition triggers/clears.

   • If you select Bad Polls, Changed, Changed From, or Changed To in the Comparison field, enter the number of minutes in which the condition must occur at least once before the condition triggers/clears. The Duration for these Comparisons must be equal to or greater than the poll frequency of the device or an alert does not trigger.

     As of SevOne NMS 5.7.2.22, when creating a new condition, Duration greater than 120 minutes (2 hours) is no longer allowed. However, for existing Policies, if the Duration is set to greater than 120 minutes (2 hours), it will maintain the duration and not be changed.

6. Click the Aggregation drop-down and select a data aggregation method. When Count Over Threshold option is chosen from the drop-down, Count field becomes available. Specify the count number in the Count field. When Time Over Threshold option is chosen from the drop-down, Time field becomes available. Specify the time in minutes in the Time field.

   The configured time in Time Over Threshold should not be longer than the value set in field Duration.

7. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General tab. You can enter variables to display such things as device name, IP address etc. See the Custom Message Variables list below.

8. Click Save to save the condition.

Baseline Conditions

Baseline conditions compare the current value of an indicator with the indicator's baseline value. There are three types of baseline conditions.

• Baseline Delta - Examples:

  • Inbound traffic is greater than 10Mb/s, relative to the baseline

  • Idle CPU time is less than 5% of the total, relative to the baseline

• Baseline Percentage - Examples:

  • Inbound traffic is greater than 150% of the baseline

  • Idle CPU time is less than 60% of the baseline

• Baseline Standard Deviation - Examples:

  • Inbound traffic is above/below three standard deviations of the baseline

  • Idle CPU time is below two standard deviations of the baseline

    Details:

    • If the baseline value is 100 and the standard deviation is 50, this does not model the expected actual value, since this appears to shift above and below the baseline value by a significant amount.

    • If the baseline value is 100 and the standard deviation is 10, this is a better representation of the normal value.

Perform the following steps to define a Baseline condition

1. Click the Indicator drop-down and select the indicator on which to base the condition.

2. Click the Type drop-down.

   • Select Baseline Delta to compare the actual current indicator value to the indicator's baseline value.

     1. In the Threshold field, enter the value at which to trigger/clear the condition then click the Threshold drop-down and select the value unit of measure. Percentage refers to a percentage of the maximum value of the indicator and is not to be interpreted as a percentage of the baseline value.

     2. Click the Comparison drop-down and select a comparison operator.

   • Select Baseline Percentage to compare the ratio of the current indicator value to the indicator's baseline value.

     1. Click the Comparison drop-down and select a comparison operator.

     2. In the Threshold field, enter the percentage value at which to trigger/clear the condition.

   • Select Baseline Standard Deviation to compare the current indicator value to the indicator's expected regional value using standard deviations which is a measure that approximates the uncertainty of the value. Most data can be expected to be within six standard deviations of the baseline. A typical condition will test whether the data is above and/or below two or three standard deviations from the baseline value.

     1. Click the Standard Deviations drop-down and select the number of deviations. A smaller standard deviation means a tighter bracket on what is normal. The size of the standard deviation should represent the behavior of the data.

     2. Click the Direction drop-down and select Above, Below, or Above or Below the baseline. The most common use case is for Above or Below to have the condition test for deviations in both directions.

3. The Duration field has two scenarios, a smoothing time duration or a detection time duration.

   • If you select Greater Than, Less Than, Equal To, Greater Than Equal To, Less Than Equal To, or Not Equal To in the Comparison field, enter the number of minutes for which the condition is to be met before the condition triggers/clears.

   • If you select Bad Polls, Changed, Changed From, or Changed To in the Comparison field, enter the number of minutes in which the condition must occur at least once before the condition triggers/clears. The Duration for these Comparisons must be equal to or greater than the poll frequency of the device or an alert does not trigger.

     As of SevOne NMS 5.7.2.22, when creating a new condition, Duration greater than 120 minutes (2 hours) is no longer allowed. However, for existing Policies, if the Duration is set to greater than 120 minutes (2 hours), it will maintain the duration and not be changed.

4. Click the Aggregation drop-down and select a data aggregation method.

5. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General tab. You can enter variables to display such things as device name, IP address etc. See the Custom Message Variables list below.

6. Click Save to save the condition.

Slope Conditions

Slope conditions use a data window of six data points (minimum of four valid points) to perform the deviation from average (DFA) calculation or the relative standard deviation (RSD) calculation. The result of the calculation is compared to the threshold you define in the condition to trigger or clear the policy. Slope conditions looks for variation of a value from the values that came before to measure the relative consistency. This detects a significant change in behavior over a short time. A data window consists of at least four successful poll points and at most six successful poll point. As each new data point is received, the oldest data point is dropped and the new data point is validated. Whenever there are between four and six valid data points, the calculation is performed for the condition.

There are two types of slope conditions

• Slope Variance DFA - Algorithm = std::abs( (P-avg)/avg )

  • P = The value of the point.

  • avg = The average of the points within data window.

  • The return value is an absolute value that represents both increasing slope and decreasing slope at the same time.

• Slope Variance RSD - Algorithm = (100*stdDev)/avg

  • stdDev = The standard deviation from data window.

  • avg = The average of the data window.

Perform the following steps to define a Slope condition.

1. Click the Indicator drop-down and select the indicator on which to base the condition.

2. Click the Type drop-down.

   • Select Slope Variance DFA to compare the current indicator value to the indicator’s deviation from average value you define. This function calculates the degree to which the current value is different from the expected value and so the default threshold values are provided. This technique is also most effective when combined with other conditions.

   • Select Slope Variance RSD to compare the current indicator value to the indicator’s relative standard deviation value you define.

3. Click the Comparison drop-down and select a comparison operator.

4. In the Threshold field, enter the numeric value at which to trigger/clear the condition.

5. Duration is irrelevant for the Slope Variance DFA condition type and for the Slope Variance RSD condition type.

6. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General tab. You can enter variables to display such things as device name, IP address etc. See the Custom Message Variables list below.

7. Click Save to save the condition.

Custom Message Variables

You can use the following variables when you enter a custom message for a trigger condition or a clear condition.

• $deviceIp displays the IP address of the device associated with this condition.

• $deviceId displays the ID of the device associated with this condition.

• $deviceName displays the name of the device associated with this condition.

• $deviceAltName displays the alternate name of the triggered device.

• $groupName displays the device group or device type that contains the device that triggered the policy.

• $pluginName displays the short name for the plugin. For example, SNMP.

• $pluginDescription displays the description of the plugin. For example, SNMP Poller.

• $objectId displays the ID of the object associated with this condition.

• $objectName displays the object name associated with this condition.

• $objectAltName displays the alternate name of the triggered object.

• $objectDescription displays the description of the object associated with this condition.

• $indicatorName displays the indicator name associated with this condition.

• $indicatorDescription displays the indicator description associated with this condition.

• $comparisonOperation displays the comparison operation being performed in this condition.

• $comparisonUnits displays the units of measurement being used in this condition.

• $comparisonValue displays the value being used for comparison in this condition.

• $dataValue displays the value observed or measured in this condition.

• $dataUnits displays the unit of measurement that is recorded for the indicator in this condition.

• $aggregationOperation displays the aggregation being used in this condition.

• $aggregationDuration displays the duration of the aggregation being used in this condition.

• $baselineValue displays the baseline value for this hour.

• $sigmaValue displays the standard deviation value for this hour.

• $sigmaDirection displays the standard deviation direction used in this condition.

• $policyId displays the id of the policy.

• $policyName displays the name of the policy.

• $thresholdId displays the ID of the threshold.

• $thresholdName displays the name of the threshold.

• $thresholdValue displays the reference value over which the condition triggers.

• $alertState displays the severity of the policy. For example, Emergency or Debug.

• $alertType displays the technology type of the policy.

Boolean Operators

Boolean AND Operator
The Action icons enable you to create new conditions, create new rules, and to manage the conditions to rules assignments.

To combine several conditions as a Boolean AND operator, add all of the applicable conditions to a single rule so that the Trigger/Clear Condition tab displays the conditions as "Rule 1 | Conditions A AND B AND C" etc.

Boolean - AND Operator

Boolean OR Operator
To combine several conditions as a Boolean OR operator, create two or more rules and add applicable conditions to the applicable rules so that the Trigger/Clear Condition tab displays the conditions for the first rule OR the conditions for the second rule, OR conditions for the third rule, etc.

Boolean - OR Operator