Administering Critical Events › Understanding Configuration Manager › How Alert Management Works

How Alert Management Works

The Alert Management System (AMS) works with Event Management System (EMS) and Advanced Event Correlation (AEC) to capture the most important events so that you can respond to them quickly. Alerts are displayed on the Management Command Center (Unicenter MCC).

This is how AMS works:

• Alert profiles assign properties to alerts when they are created, escalated, transferred, and so on. The first thing you should do is define the objects that assign the properties. These objects include:
  • Alert classes, which organize alerts and supply most of their initial properties. Classes specify which of the other profiles are associated with alerts.
  • Alert queues, which specify how alerts are grouped for viewing on the Unicenter MCC. Alert queues can be for departments like Accounting, Research and Development, and Marketing. Alert queues can also be for your WorldView business processes. Alerts in each queue are shown in separate viewers on the Unicenter MCC.
  • Alert Global Definition, which specifies properties that apply to all alerts and to the entire Alert Management System.
  • Display attributes, which specify how alerts look on the Management Command Center. Examples of attribute properties are text color, blinking text, and more.
• Event Management message policy determines the conditions that prompt alert creation. Message records and actions for alerts use the ALERT message action. You assign initial properties for alerts by indicating the alert class in the message action.

  Note: Alerts should be a small subset of the events that occur. They should represent only events that require human intervention or provide information critical to continued normal operations. We recommend no more than 1,000 alerts per day. There are two reasons for this. First, if few alerts are generated, the operations staff can focus more easily on what is important. Second, AMS is a complex system and each alert consumes more computing resources than other events. By carefully designing your AMS configuration and policy, you can help ensure that you get the most benefit from AMS.

• Advanced Event Correlation can generate correlation alerts directly into the Management Command Center. The alert class is specified at the engine level of the policy and each rule can enable or disable alert generation to that class.
• Alerts are shown by alert queue or managed object in the Management Command Center:
  • The queues you have defined are listed in the left pane when Alerts is chosen from the drop-down list above that pane. When you select a queue in the left pane, the alerts in that queue are shown in the right pane. You can open multiple queues in the right pane, and lock them in place as you move to other areas of the Unicenter MCC.
  • A bar chart of alert statistics is displayed when you right-click a node in the left pane and choose Viewers Status. The chart shows the total number of alerts for the node broken down by queue and priority.
  • Alerts for a managed object in the Topology view are displayed when you right-click the object and choose Alert Viewer from the context menu. Periodically, an association daemon polls the alert table for unassociated alerts and links them to their origin node.
  • The context menu that opens when you right-click individual alerts in the right pane lets you acknowledge alerts, view their properties, transfer them to another queue, and more.
• AMS provides a connection to Unicenter Service Desk, which is a customer support application that manages calls, tracks problem resolution, shares corporate knowledge, and manages IT assets. You can open and resolve Service Desk trouble tickets without leaving the Unicenter MCC. Besides viewing trouble tickets from AMS, you can also view them for managed objects in the Topology view.
• AMS also integrates with eHealth Suite, which delivers fault, availability, and performance management across heterogeneous systems and application environments. Based on policy that you deploy, eHealth alarms and netHealth exceptions create alerts automatically. When an alert or alarm is closed by either AMS or eHealth, the corresponding alert or alarm is also closed. You can display eHealth At-a-Glance and Alarm Detail reports for a selected alert from the context menu or the My Actions menu in the Unicenter MCC.

More information:

Alert Queues

Alert Classes

Other Alert Profiles

Message Policy for Alerts

AEC Policy for Alerts

Viewing and Responding to Alerts in the Management Command Center

Integrating with Unicenter Service Desk