Get notified when a device goes offline or fills up (alerts)

What it is for

A server has been gone for half an hour, a disk is filling up — you want to know before the customer calls. Alerts check your devices against rules you set and report by email, as a ticket, via a webhook or by starting a workflow. In the console an access is called tenant.

What you need

• Create rules: role tenant administrator or higher. Acknowledge alerts: technician or higher.
• Offline alerts need nothing else.
• CPU, memory, paging, disk need the extended inventory — it delivers the measured values (G9). It only exists with your own relay. macOS devices do not report measured values yet.
• For email: a mail server — your access's (tab Email in the access) or the relay's.
• For ticket and webhook: the ticket system (G4).

How to do it

Create a rule

1. Sidebar Alerts → tab Rules → New rule.
2. In the dialog: - Applies to: your access. The system administrator can also choose Relay default (all tenants). - Type: CPU load, Memory, Paging, Disk or Offline. - Name. - Threshold (%) (not for offline). - Duration (minutes, 0 = immediately) — the value must stay above the threshold this long without a break. For offline the field is called Offline for (minutes), at least 5. - Only devices with tag (empty = all). - Mail to up to five addresses, comma-separated. - Ticks Webhook of the ticket system integration (device.alert) and Create ticket (ticket system only). - Rule is active.
3. Save.

A new rule suggests values per type: CPU 90 % over 10 minutes, memory 95 % over 10 minutes, paging 90 % over 10 minutes, disk 90 % immediately, offline after 30 minutes.

Handle open alerts

1. Sidebar Alerts → tab Alerts.
2. Narrow down with Active, Unacknowledged, Over and All; choose the access under Tenant or leave All tenants.
3. Acknowledge: the alert stays active until the value is fine again, but no longer counts as open.
4. A click on the device opens its details.

Let a workflow start

In a workflow under Schedules and triggers… create a trigger with the event Alert raised — for example to start a clean-up script when the disk is full (G8).

How you know it worked

• In the Overview the tile Open alerts shows the number of unacknowledged alerts.
• In the device's details the open alert is shown at the top under Overview.
• The email arrives when the alert is raised and again when it clears.

Good to know

• Clearing only 5 percentage points below the threshold. So an alert does not flap with every value close to the threshold.
• Default and own rule: a relay default applies in your access as long as you have no own rule of the same type. To switch a default off, create your own rule of that type and leave it inactive. The default then shows Replaced in: with your access.
• At most one open alert per device and rule — and so at most one email until it clears.
• Limits: 5 recipients per rule, 50 rules per access, 60 alert emails per access and hour.
• After a relay restart the duration starts again; "offline" counts at the earliest from the relay's start.
• Measured-value alerts of a device that goes offline stay open until it measures again.
• Closed alerts stay in the history for 90 days.
• Unmeasured on devices: real email, real webhook and an alert from a real device via a running relay have not been measured yet.

If it does not work