Administration Guide › Action Alerts › Action Alert Considerations

Action Alert Considerations

You can view the results of any action alert from CA Enterprise Log Manager without any special configuration. Additionally, an action alert can be sent to the following destinations:

• RSS feed
• Email recipients
• SNMP trap destinations, such as CA Spectrum or CA NSM
• A CA IT PAM event/alert output process

Administrators configure these destinations from the Administration tab, Services subtab, under either Global Configuration or Global Service Configuration: Report Server.

Ensure these destinations are configured as follows before attempting to schedule an alert.

• To use the Feed Reader, ensure the checkbox is cleared for Viewing Action Alerts Require Authentication in the Global Configuration.

  The RSS Feed URL follows, where elmhostname is the host name of the CA Enterprise Log Manager server:

   https://{elmhostname}:5250/spin/calm/getActionQueryRssFeeds.csp
  

• To send alerts to email recipients, ensure the Email Settings section is configured in the Global Service Configuration: Report Server.
• (Optional) To send alerts to SNMP destinations, ensure SNMP Configuration section is configured in Global Service Configuration: Report Server.
• To send alerts to the CA IT PAM event/alert output process, ensure the IT PAM section is configured in Global Service Configuration: Report Server. (The only value not required for alerts is that for the Dynamic Values process.)

When you specify result conditions for an action alert, consider the following:

• Use the preset dynamic start time and dynamic end time for the predefined ranges.
  • The predefined range, last 5 minutes, is set with the dynamic end time to 'now', '-2 minutes' and the dynamic start time to 'now', '-7 minutes.' This default range and the other predefined time ranges allow adequate time for the events to be saved to the database.

    Note: Do not change the dynamic end time to 'now' or to 'now', '-1 minutes'. This change from the predefined value can cause incomplete data to be displayed when the URL is launched from the destination. For example, if event count is one of the values, the displayed count when viewed from the URL may be less than the displayed count when viewed from CA Enterprise Log Manager.

• Extend the dynamic end time if incomplete data is displayed with the default setting. For example, set it to 'now', '-10 minutes'

When you create an action alert schedule, consider the following:

• The recurrence interval is the frequency with which the query is run. Therefore, a recurrence interval of 5 minutes means the query is run every five minutes, or 12 times per hour. An action alert is generated only if the query returns results when it is run.
• Set the recurrence interval based on how time critical it is for you to respond when the tested condition occurs.
  • If you need to take immediate action to remedy the condition, set the recurrence interval to a high frequency so you can be notified as soon as possible.
  • If the condition is one that you want to track, but not one that requires intervention, set the recurrence interval to a low frequency.
• Avoid setting the recurrence interval to a high frequency, such as every five minutes, if your CA Enterprise Log Manager server time is not synchronized with your NTP server.

  Important! Your CA Enterprise Log Manager server time must be synchronized with your NTP server to ensure complete results are returned when the query is set to run at a high frequency.

Consider the following filtering options:

• To use the filters that are defined with the included queries, no action is needed.
• To apply additional filters to the queries included in an alert, define them in the Alert Filters step.
• To apply the same set of filters to multiple alert jobs, use a profile.

Before you configure thresholds for action alerts on a CA Enterprise Log Manager report server, consider the following:

• To keep the RSS feed to a reasonable size, set the maximum number of alerts to allow. The more frequent the recurrence intervals on enabled alerts, the faster the feed will fill up if the query or queries return results.
• To ensure that the RSS feed does not retain alerts longer than the data is of interest, specify the action alert retention to the maximum age in days of the oldest record to retain.
• Consider how often you want to check the RSS feed for alerts. That frequency can help you plan how long to keep records.
• If you want the RSS feed to display the most recent result of all jobs at all times, configure the retention values such that infrequently run alerts don't get deleted because they are older than frequently run alerts that fill the queue to capacity.

More information:

Configure Action Alert Retention

Example: Create an Action Alert for Low Disk Space