What's the best approach for withholding SiS alerts from BSM until they are repeated X times

We are monitoring the CPU of some remote servers on Sitescope 11.24, and using the HP Integration Settings to send the monitor results to BSM 9.25, and we use CI status alerts on BSM to notify of error conditions through email (this last part is standard practice in our environment and not specific to only these CPU monitors), as well as the followup back-to-good condition.

Since we can't control the status of the Sitescope monitor depending on the time it's been on an specific state, what we have done so far is just get whatever status it sends and then configure the CI status alerts to only send the email if the CI has been on a certain state for over 10 minutes.

This is certainly not optimal, on one hand because the "send alert if status is equal or worse than warning for 10 minutes" doesn't seem to send any email ever even when it's been on error for almost half and hour, but also because we would be getting followup back-to-good emails even if the "worse than warning for 10 minutes" alert condition wasn't ever met.

I guess the correct approach would involve using Sitescope alerts, where we can configure how many times a condition must be met before triggering the alert, but I'm not sure about how to implement that with SiS-BSM.

If I configure a Trigger alert action then that should generate an event when the Status Trigger and Trigger Frequency are matched by the monitor status, but how does that work with BSM? Do I need to configure a specific setting in Sitescope's HP Integration Settings so that only events generated through this SiS alert impact on the CI?

Regards.

 

PS: we don't have OMi (which is why I'm finding the use of alert events confusing).

  • Verified Answer

    hi J

    as you already found out, SiS Alerts will not impact HIs of CIs thus they will not "color" KPIs and won't work for your CI Status Alerts approach for sending emails.

    since you dont have OMi i am assuming you configured the monitors in HP Integration Settings to affect Service Health by Mertics. this means you can use different Business Rule on the CPU HI (or any HI coming from SiS) and in your rule you will need to implement the logic that you want (for example: status will be "critical" only if there are at least 3 cosequtive failed samples). this is advanced topic but you can find more info in Extensibility Guide.

    your other option will be to use the SiS Alerts to send email, instead of sending the email from CI Status Alerts. this means when a monitor will fail 3 times, the Alert will trigger an email notification. I think that for the "follow up" email you will need additional Alert, but i am not sure.

    let me know if you need more info,

    Asaf