What are Incidents? › How Incidents Trigger Responses

How Incidents Trigger Responses

UC Monitor creates an incident when it detects a condition on the network that exceeds a threshold. If an action is associated with the threshold condition, UC Monitor launches that action automatically, as shown in the following diagram:

Keep in mind the following details about incidents, incident responses, and actions:

• UC Monitor creates an incident the first time a threshold is crossed.
• UC Monitor creates another incident for the same violation only after the first incident is closed.
• To trigger an incident, a violation must exceed minimum severity and duration criteria.
• A UC Monitor administrator can associate an incident response with the incident type.
• For a few incidents, such as the Abnormal Termination incident, no applicable metrics are monitored for improvement so that the incident can be closed. Therefore, the incident is briefly opened to trigger automatic actions and is then immediately closed. The accompanying email or SNMP trap notification indicates that the incident is open, but in fact closure is pending.
• The traceroute investigation action is configured as an incident response action for call setup or call server group incidents only.

  The results of a traceroute investigation for other types of incidents, such as call quality, are not helpful. Traceroutes begin at the collector, which is located so closely to the call server that little is determined from the route for call traffic.

  For call server group incidents, the collector attempts to run a traceroute to the key phone at the affected Location.

A traceroute investigation can also be launched independently of an incident.