Configuring alarm policies

As a tenant administrator, use alarm policies to safeguard against abnormalities by configuring thresholds. Thresholds define an acceptable value above or below which an alarm is generated. 

You can manually configure alarm policies or configure automatic anomaly event generation to detect anomalies. Alarms are events generated when threshold values are violated. You can configure the threshold values. Thresholds define an acceptable value above, below, or within a specified region when an alarm is generated. Thresholds can be applied to multiple monitor types on multiple PATROL Agents.

You can perform the following operations on alarm policies:

• Create, edit, view, and delete alarm policies.
• Export all alarm policy data to a CSV file.
• View a list of alarm policy conflicts, where alarm policies with the same severity are defined for the same metric.
• View the audit trail of all updates made to all alarm policies.

To create an alarm policy

If you are creating an alarm policy for dynamic monitor types, make sure that monitor instances are available for a device in the Devices > Device Details > Monitors tab.

1. Select the Configuration > Alarm Policies page and click Create.
2. In the Policy Information section, enter a Name and Description for the policy.
3. In the Precedence field, add a unique precedence number to the policy.
   You can add a custom value in this field, or use the arrows to increase or decrease the value. For more information, see Alarm policies.
4. Use the Alarm Genaration Conditions section to create the conditions based on which the alarm will be generated.
   
   Perform the following steps to create the conditions:
   1. In the For field, click  to select a monitor type. 
      You can select one of the following monitor types:
      • BMC Monitor Types
      • BMC Dynamic Monitor Types
        You must first enable the dynamic monitor types for metric selection. For more information, see Dynamic enrichment policy data table management endpoints in the REST API.
      • Third Party Monitor Types
   2. In the On field, select one of the following options:
      • All Instances
      • Multi Instances: For multiple instances, you can define multiple conditions using parameters such as agent tag name, hostname, instance name, port, etc. You can also use regular expressions while defining multiple instances by using the Matches operator.
        You cannot create multiple alarm polices with the same metrics and conditions. You can create policies with the same metrics and conditions only if the instance type is different. The instance type can be All or Multiple.
        If you create multiple alarm polices with the same metrics, same conditions, and different instance types, the policy with the Multiple instance type takes precedence.
   3. In the next field, add the instance details.
      You can also copy the criteria by clicking Copy . The copied criteria can be reused in subsequent policies by pressing Ctrl+V in the selection criteria field.
      Important:
      • The instance name is case sensitive. Ensure that you use the instance name as displayed in the Device Details page while defining the selection criteria.
      • The instance name that you enter in the alarm policy is displayed in the object slot for an alarm event and not in the instancename slot on the Events page.

   4. (Optional) Click  to view the devices that satisfy the selection criteria.
      Important:
      The Preview button is disabled if you specify the Device Host Name and Instance Name in the selection criteria.

   5. Use the If and Then fields to add the baseline condition, threshold value, violation duration, and details about when the generated alarm must be closed eventually.
   6. (Optional) Use the Add Condition option to add another condition for the same metric, or use the Clone Condition option to clone and customize the current condition.

      Important: If you have multiple conditions with varying threshold values and severity levels, an alarm is generated when the first condition is breached. When the next condition is breached, a new alarm is not generated. Instead, the severity of the first alarm changes.

      For example, if the condition is set as 

      If CPU utilization exceeds 75% for 15 minutes, generate a Major alarm. If CPU utilization exceeds 85% for 15 minutes, generate a Critical alarm.

      In this scenario, when the CPU utilization for the system crosses 75% for a period of 15 minutes, a Major alarm is generated. When the CPU utilization of the same system crosses 85%, the earlier alarm severity changes from Major to Critical. If the CPU utilization returns to 75%, the alarm severity changes from Critical to Major.

   7. (Optional) Use the Add New Metric option to add an alarm generation condition for a different metric.
5. (Optional) Select Enable Policy.
   You can enable or disable the policy at any time from the Alarm Policies page.
6. Save the policy.

Examples for defining conditions

To edit an alarm policy

1. Select the Configuration > Alarm Policies page and do one of the following:
   • Select the policy and click Edit.
   • From the Actions menu of a policy, select Edit.
2. Change the configuration details provided while creating the policy and click Save.

When you edit an alarm policy, the system incrementally loads 25 threshold values at once on a page scroll to improve usability.

If you update the precedence of existing policies, the system automatically closes open alarms associated with the policy and generates new alarms for any subsequent metric threshold violations for that policy.

You cannot search thresholds that are not yet loaded on the page.

To export alarm policies to a CSV file

1. Make sure that you have the permission to read alarm policies.
2. Select Configuration > Alarm Policies.
3. Click the Download icon .
4. Click Alarm policies report.
   The data of all alarm policies is downloaded in a CSV file. You can save the file on your local computer. 

To view conflicting alarm policies

1. Select Configuration > Alarm Policies.
2. Click the Download icon .
3. Click Policy conflicts report.
   A policy conflict report that contains the list of conflicting alarm policies is downloaded as a PDF file.

The policy conflict report might take some time to be generated. Other functions on the user interface are not impacted if the PDF file download is in progress.

To copy an alarm policy

1. Select the Configuration > Alarm Policies.
2. Click the action menu of the policy that you want to copy and select Copy. 
   The Create Alarm Policy page is displayed with the configurations of the copied policy. 
3. Modify the configurations according to your requirements to create a new policy quickly. 
4. (Optional) Select Enable Policy.
   You can enable or disable the policy any time from the Alarm Policies page.
5. Save the policy.

To view the list of alarm policies

On the Configuration > Alarm Policies page, view the list of alarm policies.

By default, the policies are sorted by Name. To sort on a different column, click the column heading.

To enable or disable an alarm policy

On the Configuration > Alarm Policies page, do one of the following:

• Select the policy and click Enable or Disable.
• From the Actions menu of a policy, select Enable or Disable.
• Edit the policy and select or clear the Enable Policy check box.

To delete an alarm policy

On the Configuration > Alarm Policies page, do one of the following:

• Select one or more policies and click Delete.
• From the Actions menu of a policy, select Delete, and click Yes.

In the policy post-trigger actions, if you have specified that the alarm must not be closed, such alarm events are automatically closed if they are not updated for more than the period specified in the retention policy. All closed events are automatically deleted from the system as per the retention policy. However, if you delete such a policy or the PATROL Agent associated with such an alarm is deleted, the alarm is automatically closed.

For more information about the retention policy, see BMC Helix Operations Management service.

To view the audit trail of alarm policies

As a tenant administrator, you can use the BMC Helix Audit dashboard in BMC Helix Dashboards, to view the trail of all changes that were made to alarm policies. The BMC Helix Audit Dashboard provides the audit trail of alarm policies. 

For more information, see BMC Helix Audit Dashboard.

The following image displays the audit trail of alarm policies in the BMC Helix Portal Audit dashboard. Note that the selected resource type is Alarm Policy.

Related topics

Alarm policy management endpoints in the REST API