Page History

You can integrate your SimpleOne instance with any preferred active monitoring system (AMS) for supervising the stability and performance of your system. The AMS primary function is to query the

observation object statuses and generate alerts if necessary. After that, using the data exchange mechanism between the AMS and the SimpleOne instance, based on these alerts, events are created

with the desired notification type and some parameters set by the monitoring rules. These may be exception events, warning events, and information events

.

The

following scheme shows the whole process of the monitoring and event management:

Image Added

Exception Events

Exception events

have the highest priority

on this list. An example of

an exception event can be unavailability of a server or any other crucial service

.

The processing of exception events using the events correlation engine is listed below (we will use the example with the server):

1. The AMS

1. sends a message: "server is unreachable".
2. On the SimpleOne instance, in accordance with the

1. monitoring rules specified, the Exception monitoring event

1. is created, identical to the

1. message and

1. in the Active

1. state.
2. The event is checked against the event rule. The system starts counting down the revalidation period (for example, the period is three minutes). The period should pass before the revalidation. During this period, no actions can be undertaken.
3. Once the period expires, the system checks the state

1. of the event associated with

1. the message (the monitoring system updates

1. message states, and the event

1. states synchronize with them):
   1. If the event

1. 1. state is still Active

1. 1. – submit an incident immediately.
   2. If the event

1. 1. state has changed to Inactive, then the incident will not be created.

Warning Events

Warning events have

a lower priority than exceptions. An example of

a warning

event can be

low disk space

.

The processing of warning events using the events correlation engine is listed below (we will use the example with the disk space):

1. The AMS throws an alert

1. : "disk space is running out, X Mb left".
2. On the SimpleOne instance, in accordance with the

1. monitoring rules specified, the Warning event

1. is created, identical to the alert and

1. in the Active

1. state.
2. As opposed to the Exception events,

1. the system does not start counting down the revalidation period. In accordance with the settings specified, to launch the

1. revalidation period, there must be two active Warning events for this alert.
2. If the second Warning event

1. is received, then the

1. revalidation periods starts. The period should pass before any actions can be undertaken.

1. After the period expires, the system checks the state of the events associated with

1. the message (the monitoring system updates

1. message states, and the event

1. states synchronize with them):
   1. If all the events are still Active

1. 1. – raise an infrastructure incident immediately.
   2. If at least one event is Inactive, then the

1. 1. incident will not be raised.

Information Events

Information events are the lowest-priority events, and they are merely informational. An example of

an information event is a user authorization notification.

It is only necessary to

obtain many similar events for a specified period, for example, ten login

attempts of the same user per minute.

The processing of information events using the events correlation engine is listed below (we will use the example with the

login attempts):

1. The AMS

1. sends a message: "John Doe

1. logs in".
2. The Monitoring and Event

1. Management module collects ten login

1. attempts of the same user per minute.
2. After that,

1. the system raises an

1. incident about the suspicious activity. In this case,

1. the revalidation period is not used.