Understanding event states

The event list displays sufficient information for you to recognize an event's current state quickly. Each event's state depends on multiple factors:

  • Severity, reflected in the severity icon and color of the event line
  • Priority, reflected in the priority icon
  • The most recent event operation performed on the event, reflected in the status icon 

This topic provides the following information about event states:

Event status

The status of an event provides basic information about the event's response activity. The BMC TrueSight Operations Management Server assigns a status value to each event, and then you can change the status by performing event operations or other actions on the event. Also, a rule can change the status of an event automatically. 

The following table lists the icons that are displayed in the event list to represent event status:

Icon Event status
Open
Closed
Acknowledged
Assigned
Blackout

Event states resulting from event operations

When you perform an event operation on an event, the state of the event changes according to the following table. For information about performing event operations, see Performing event operations in the TrueSight console.

Event operation performed Resulting event state
Acknowledge Event Acknowledged
Take Ownership Assigned
Decline Ownership Acknowledged
Assign To Assigned
Close Event Closed
Unacknowledge Event Open
Black Out Blackout

The following figure shows how an event in any state is affected by the operations that are valid for that current state. The circles represent the event states. Each arrow represents an action, with the direction of the arrow indicating the flow of the action. For example, if the event is currently in the Acknowledged state, you can perform a Take Ownership, Assign To, Close Event, or Unacknowledge Event action. Conversely, for that event to be in the Acknowledged state, you must perform an Acknowledge Event or Decline Ownership action.

Event severity

Each event has a severity level associated with it and indicates the seriousness of the event. In combination with status and priority, the severity level indicates the urgency of the need to take action. For example, a Major severity level for an event in the Closed status is no cause for alarm, but a Major severity level for an event in the Open status and with a priority of 1 indicates an urgent need for action.

The following table lists the default severity levels and colors for the events that appear in the event list. For closed events, the icons are in gray color.

Icon Color Event severity level
Red Critical
Dark orange Major

Light orange

Minor
Yellow Warning
Blue Information
Green OK
Teal Unknown

Event priority

In addition to a severity level, each event has a priority level. Distinguishing between severity and priority helps you to understand which event requires action first.

The priority icon for an event has the same color as the event severity. For closed events, the icons are in gray color.

The following table lists the icons that are displayed in the event list to represent event priority:

Icon Event priority

Highest

High

Medium

Low

Lowest

Related topics

Monitoring and managing events

Filtering events in the TrueSight console

Viewing event details in the TrueSight console

Was this page helpful? Yes No Submitting... Thank you

Comments