Page History

You can integrate your SimpleOne instance with any preferred active monitoring system (AMS) for supervising the stability and performance of your system. The AMS 's primary function is to query the state of service or CI status and generate alerts if necessary. Based After that, using the data exchange mechanism between the AMS and the SimpleOne instance, based on these alerts, events are created typified by the alert priority . These (these may be exception events, warning events, and information events).

The event correlation engine allows configuring the system behavior rules depending on the event type . For (for example, whether or not to create an Incident if an Exception event has been thrown).

The rules listed below are provisional and can be configured in line with your business tasks and objectives.

...

Exception events are the highest priority ones from event typesthis list. An example of an the exception event can be a server or any other crucial service unavailability.

The processing of exception events using the events correlation engine is listed below (we will use the example with the server):

1. The AMS throws an alert "server is unreachable".
2. On a SimpleOne instance, in accordance with the settings specified, the Exception event was created, identical to the alert , and has the having Active state status.
3. The The Debounce Engine has started to work, and the specified period should pass before any actions can be undertaken . For (for example, the period is three minutes).
4. Checking the state status of the event associated with this alert (the monitoring system updates alert states, and the event states statuses synchronize with them):
   1. If the event
   state
   1. status is still Active - submit an incident immediately.
   2. If the event
   state
   1. status has changed to Inactive, then the incident will not be created.

Warning Events

...

Warning events have less priority than exceptions. An example of a the warning event events can be like "disk space is running out, X Mb left".

The processing of warning events using the events correlation engine is listed below (we will use the example with the disk space):

1. The AMS throws an alert looking like alike "disk space is running out, X Mb left".
2. On SimpleOne instance, in accordance with the settings specified, the Warning event was created, identical to the alert , and has the having Active state status.
3. As opposed to the Exception events, we do not launch the Debounce engine and do not start a countdown. In accordance with the settings specified, to launch the Debounce Engine, there must be two active Warning events for this alert.
4. If the second Warning event was received, then the Debounce engine launches and the specified period should pass before any actions can be undertaken.
5. Checking the status of the events associated with this alert (the monitoring system updates alert statuses, and the event statuses synchronize with them):
   1. If all the events are still Active - raise the Incident immediately.
   2. If at least one event is Inactive, then the Incident will not be raised.

Information Events

...

Information events are the lowest-priority events, and they are merely informational. An example of an the information event is a user authorization notification. In there, it is only necessary to gain many similar events for a specified period, for example, ten login events of the same user per minute.

The processing of information events using events correlation engine is listed below (we will use the example with the logins):

1. The AMS throws an alert looking like alike "John Doe tries to log in ten times per minute".
2. The Event Monitoring module collects ten login events of the same user per minute.
3. After that, it raises an incident about suspicious activity. In this case, the the Debounce Engine is not used.

This picture illustrates the basic principles of the work of the Event Correlation engine.

ITSM Event form table fields

Event Rule form table fields