Alarm event class
The Alarm (or ALARM) event class is a subclass of the MonitorEvent event class, which is a subclass of the EVENT base event class.
This class represents slots for Alarm events that have a severity of Critical, Major, or Minor.
The hidden slots are internal slots that must not be changed.
To understand the list of slots that are used to determine duplicate events, see Slot facets.
|Slot name||Slot display name||Type||Description||Hidden?|
Name of the agent.
|String||Operating system of the agent.||No|
|Agent Port||String||Agent port number.||No|
|Alarm ID||String||Internal ID for an alarm.||No|
The machine learning algorithm name for the baseline. The t-digest algorithm is used.
|String||The average value of a metric in the predicted alarm. This slot is unused.||No|
Baseline Daily High
|Indicates a high value for the daily baseline. This slot is unused.|
Baseline Daily Low
|Indicates a low value for the daily baseline. This slot is unused.|
Baseline Hourly High
|Indicates a high value for the hourly baseline.|
The type of baseline. Following are the baseline types:
This slot is unused.
Baseline Weekly High
|Indicates a high value for the weekly baseline. This slot is unused.|
Baseline Weekly Low
|Indicates a low value for the weekly baseline. This slot is unused.|
|Agent IPAddress||String||IP address of the agent device.||Yes|
Date (Epoch milliseconds)
Time when the alarm gets closed automatically.
|Float||The score that is calculated for the predicted alarm. This slot is unused.||Yes|
|Indicates the abnormality score in case of abnormality events. This slot is unused.|
Alarm Highest Severity
|Severity||Highest severity of the event.||Yes|
|Boolean||Indicates whether or not the alarm has a predictive severity. This slot is unused.||No|
Date (Epoch milliseconds)
Timestamp of the last data point that triggered the alarm.
|Alarm Old Severity||Severity||Old severity of the event.||Yes|
Name of the metric or property that went into the alarm or that triggered the event.
Threshold value that was crossed to cause generation of the event.
Unit description of the metric.
Actual value of the parameter.
|Date (Epoch milliseconds)||The time when the predictive alarm is predicted to occur. This slot is unused.||No|
The severity of the predicted alarm event. This slot is unused.
|Indicates the abnormality exceeded value in case of abnormality events. This slot is unused.|
Indicates the value that is calculated for the abnormality points in case of abnormality events. This slot is unused.
Indicates whether the threshold is configured with a greater than condition. If the greater than condition is selected, the value of this slot is set to true, otherwise it is set to false.
Example: Suppose you configured to raise an alarm when CPU utilization is greater than 75%. In this scenario, the value of this slot is set to true.
Violation duration (in minutes) that data points must meet before the event is created.
System generated unique ID for a threshold object. It is a combination of the monitor type, monitor type ID, monitor instance name, attribute (or metric) ID, severity, and tenant name.
|Threshold Type||String||Indicates that the threshold is user defined.||Yes|
Cross Launch URI
|String||Address used to cross-launch directly to the component.||No|
|Indicates the label that is associated with the entity.|
The custom tag that represents an entity or a monitor in case of third-party data ingestion.
|String||Category of the related incident event.||No|
|Incident Item||String||Item attribute of the related incident event.||No|
|Incident Operational Category1||String|
Operational Categorization 1 value for the specified event. The same gets populated into Op cat 1 for the incident.
Incident Operational Category2
|String||Operational Categorization 2 value for the specified event. The same gets populated into Op cat 2 for the incident.||No|
Incident Operational Category3
|String||Operational Categorization 3 value for the specified event. The same gets populated into Op cat 3 for the incident.||No|
|Incident Type||String||Type of the related incident event.||No|
|Object||String||Sub-component of the host to which the event is related.|
For example, it could be the name of the disk on which the event is reporting the problem.
|Object Class||String||Identifies the class of an object. If the object class cannot be derived from the original event, it must be filled in during enrichment.||No|
It is a combination of Agent guid, Monitor type, and Instance name.