Alarm event class

al_agent_name

Agent Name

String

Name of the agent.

No

 al_agent_os

Agent OS

String

Operating system of the agent.

No

 al_agent_port

Agent Port

String

Agent port number.

No

 al_agent_tag

Agent Tag

String

The Agent tag.

No

 al_alarm_id

Alarm ID

String

Internal ID for an alarm.

No

 al_algorithm_name

Algorithm Name

String

The machine learning algorithm name for the baseline. The t-digest algorithm is used.

No

 al_avg_value

Average Value

String

The average value of a metric in the predicted alarm. This slot is unused.

No

 al_baseline_daily_high

Baseline Daily High

String

Indicates a high value for the daily baseline. This slot is unused.

No

 al_baseline_daily_low

Baseline Daily Low

String

Indicates a low value for the daily baseline. This slot is unused.

No

 al_baseline_hourly_low

Baseline Hourly High

String

Indicates a high value for the hourly baseline.

No

 al_baseline_type

Baseline Type

Baseline

The type of baseline. Following are the baseline types:

• Hourly
• Daily
• Weekly

This slot is unused.

No

 al_baseline_weekly_high

Baseline Weekly High

String

Indicates a high value for the weekly baseline. This slot is unused.

No

 al_baseline_weekly_low

Baseline Weekly Low

String

Indicates a low value for the weekly baseline. This slot is unused.

No

 al_device_ipaddress

Agent IPAddress

String

IP address of the agent device.

Yes

 al_end_time

End Time

Date (Epoch milliseconds)

Time when the alarm gets closed automatically.

Yes

 al_event_score

Event Score

Float

The score that is calculated for the predicted alarm. This slot is unused.

Yes

 al_extremeness

Extremeness

Integer

Indicates the abnormality score in case of abnormality events. This slot is unused.

No

 al_highest_severity

Alarm Highest Severity

Severity

Highest severity of the event.

Yes

 al_is_predicted

Is Predictive

Boolean

Indicates whether or not the alarm has a predictive severity. This slot is unused.

No

 al_last_time

Last Time

Date (Epoch milliseconds)

Timestamp of the last data point that triggered the alarm.

Yes

 al_old_severity

Alarm Old Severity

Severity

Old severity of the event.

Yes

 al_parameter_name

Metric

String

Name of the metric or property that went into the alarm or that triggered the event.

No

 al_parameter_threshold

Parameter Threshold

String

Threshold value that was crossed to cause generation of the event.

No

 al_parameter_unit

Parameter Unit

String

Unit description of the metric.

No

 al_parameter_value

Parameter Value

String

Actual value of the parameter.

No

 al_predict_to_occur_time

Predicted Time

Date (Epoch milliseconds)

The time when the predictive alarm is predicted to occur. This slot is unused.

No

 al_prediction_severity

Predicted Severity

String

The severity of the predicted alarm event. This slot is unused.

No

 al_pts_exceeded

PTS Exceeded

Integer

Indicates the abnormality exceeded value in case of abnormality events. This slot is unused.

No

 al_pts_total

PTS Total

Integer

Indicates the value that is calculated for the abnormality points in case of abnormality events. This slot is unused.

No

 al_thresh_above

Threshold Above

Boolean

Indicates whether the threshold is configured with a greater than condition. If the greater than condition is selected, the value of this slot is set to true, otherwise it is set to false.

Example: Suppose you configured to raise an alarm when CPU utilization is greater than 75%. In this scenario, the value of this slot is set to true.

Yes

 al_thresh_duration

Threshold Duration

Integer

Violation duration (in minutes) that data points must meet before the event is created.

Yes

 al_thresh_id

Threshold ID

String

System generated unique ID for a threshold object. It is a combination of the monitor type, monitor type ID, monitor instance name, attribute (or metric) ID, severity, and tenant name.

Example: NUK_FileSystem:nuk:FreeInodes:Major:HP

Yes

 al_thresh_type

Threshold Type

String

Indicates that the threshold is user defined.

Yes

 cross_launch_uri

Cross Launch URI

String

Address used to cross-launch directly to the component.

No

 entity_identifier

Entity Identifier

String

Indicates the label that is associated with the entity.

No

 external_id

external_id

String

The custom tag that represents an entity or a monitor in case of third-party data ingestion.

No

 incident_category

Incident Category

String

Category of the related incident event.

No

 incident_item

Incident Item

String

Item attribute of the related incident event.

No

 incident_operational_category1

Incident Operational Category1

String

Operational Categorization 1 value for the specified event. The same gets populated into Op cat 1 for the incident.

No

 incident_operational_category2

Incident Operational Category2

String

Operational Categorization 2 value for the specified event. The same gets populated into Op cat 2 for the incident.

No

 incident_operational_category3

Incident Operational Category3

String

Operational Categorization 3 value for the specified event. The same gets populated into Op cat 3 for the incident.

No

 incident_type

Incident Type

String

Type of the related incident event.

No

 object

Object

String

Sub-component of the host to which the event is related.
For example, it could be the name of the disk on which the event is reporting the problem.

No

 object_class

Object Class

String

Identifies the class of an object. If the object class cannot be derived from the original event, it must be filled in during enrichment.

No

 object_id

Object ID

String

It is a combination of Agent guid, Monitor type, and Instance name.

Important: Do not enrich the object_id slot.

No