Working with Escalation Policy › How to Create Escalation Policy › Define Escalation Policy

Define Escalation Policy

As an administrator, you create escalation policy in the Operations Console as follows:

• From the Escalation Policies and Actions dialog
• When creating or editing a service in the Service Modeler
• When creating or editing an alert queue

The procedures in this section describe how to create escalation policy from the Operations Console. You can also create global escalation policy from the Alert Escalation tab of the Service Modeler. For more information about using this tab to create policy and assign it to a service, see Configure Policy Assignment by Service.

Follow these steps:

1. Start the Operations Console and select Tools, Escalation Policies and Actions.

   The Escalation Policies and Actions dialog opens.

2. Click .

   The Alert Escalation Policy Editor dialog opens.

3. Perform the following actions in the upper pane of the Policy Definition tab:
   1. Enter a policy name and optional description in the Name and Description fields.
   2. Select Enabled or Disabled to control whether the policy starts evaluating alerts immediately after you create it. If you select Disabled, you manually enable the policy when you want it to take effect.
   3. Select Global or Non-Global in the Policy Type section:

      Global

      Specifies that the policy applies to all alerts.

      Non-Global

      Specifies that the policy applies to alerts of an assigned service or alert queue.

4. Configure the alert types to escalate as follows on the Alert Selection subtab:

   Service Alerts

   Escalates all service alerts that meet the policy criteria.

   Infrastructure Alerts

   Escalates infrastructure alerts that meet the policy criteria. Select either of the following options to escalate a subset of infrastructure alerts only:

   Note: Only select one of these options if you want to limit infrastructure alert escalation to a specific subtype. Selecting Infrastructure Alerts with no subtype or both subtype selections escalates all infrastructure alerts, regardless of type.

   Root cause infrastructure alerts

   Escalates infrastructure alerts that are assigned as a root cause to a service alert.

   Symptom infrastructure alerts

   Escalates infrastructure alerts that are not a root cause of a service alert, but has been determined to be a symptom based on either a root cause policy or the domain manager (if in Domain Manager mode).

   These alert subtypes are calculated based on the escalation policy type. A service-specific policy evaluates alert subtypes against the assigned service. A global policy evaluates alert subtypes that are based on any associated service. For example, an alert belongs to a CI that is associated with five services. The alert is a root cause for one service, a global policy considers it a root cause alert. However, a service-specific policy only considers the alert a root cause alert if it is a root cause for the assigned service.

   As a best practice, only use the subtype selections with time-based escalation policy. Alert states can change after initial alert generation, which could lead to false escalations if the policy is not time-based.

   Alerts for CIs in maintenance mode

   Escalates infrastructure and service alerts for CIs that are currently in maintenance. If you clear this check box, the policy is only applied after the alert's CI is out of maintenance mode.

   Infrastructure alerts for Services in maintenance mode

   (Non-Global policy only) Escalates any type of infrastructure alert if the parent service is in maintenance. If you clear this check box, the policy is only applied after the service is out of maintenance mode. If you select the check box and the policy is assigned to multiple services, and one of the services is not in maintenance mode the policy still triggers.

   Alert type settings are configured.

5. Click the Time subtab.

   Select whether any or all selected criteria must be met, select the criteria to apply, and enter the time period on which to base the criteria for each selection.

   All selections are based on the number of minutes elapsed.

6. Click Attributes.

   Select an alert attribute on which to filter, a comparison type, and a comparison value for the attribute, and click Add.

   Consider the following information:

   For definitions of available attributes, see the topic that follows.

   • To use regular expressions, select Matches regex from the Comparison Type drop-down list. Click Test Regex to open the Regex Tester and test the regular expression against a string. Regular expressions are not available for all attributes.

   You can define criteria that are based on the following items:

   • Alert properties
   • The correlatable USM properties of the associated CI
   • The associated customer name, customer impact, custom identity, and customer priority

   The attribute expression appears in the lower pane.

7. (Optional) Add more attribute criteria and create advanced logic using the logic buttons on the right of the dialog.

   For more information about creating advanced attribute criteria, click the Hints link above the expression pane.

8. (Optional) Click Escalation Schedule to apply the policy during a specific time period.

   The Escalation Schedule subtab opens.

9. Leave the default 24x7 selection if you want the policy to be in effect always, or select one of the following options:

   Escalate only on service's business hours

   (Non-Global policy only) Escalates alerts only during the business hours schedule that is defined for the assigned service. If the assigned service has no business hours schedule, CA SOI always escalates alerts.

   Escalate only on the following selected business hours

   Escalates alerts only during a business hours schedule that you select.

10. (Optional) If you selected 'Escalate only on the following selected business hours' perform one of the following actions:
    • Select an available schedule, if any, and click .

      The schedule appears in the Current Schedules pane.

    • Click Create.

      The Create Business Hours dialog opens.

11. (New business hours only) Enter the required information in the Create Business Hours dialog, and click OK:

    Note: If you enter multiple business hours schedules, the product verifies that the hours do not overlap.

12. Click the Policy Actions tab.

    The Policy Actions tab opens with a list of available escalation actions.

13. Perform one the following actions:
    • Move actions to apply to the policy from the Available Actions pane to the Actions to Perform pane.
    • Create an escalation policy action.

    You can add multiple actions to the policy.

14. (Non-Global policy only) Select the Service Assignment tab.

    Move the services to which you want to assign the policy to the Assigned Services for this Policy pane and click OK.

    Note: Alerts on subservice CIs do not trigger a parent service's escalation policy. If you want the subservice CI alerts to trigger the policy for the parent, assign each subservice to the escalation policy.

    You can also assign service-specific policy in the Service Modeler. For more information, see Configure Policy Assignment by Service.

15. (Non-Global policy only) Select the Alert Queue Assignment tab.

    Move the alert queues to which you want to assign the policy to the Assigned Alert Queues for this Policy pane and click OK.

16. (Optional) Return to the Policy Definition tab and click Show Policy Summary.

    A text box appears at the bottom of the dialog that describes the escalation policy in a brief expression. Use this description to verify that you defined the policy correctly.

17. Click OK.

    The escalation policy is defined and appears in the Escalation Policies and Actions dialog.