Overview of Alerts Review in IT Essentials Work

The Alerts Review dashboard in IT Essentials Work enables you to investigate alerts caused by changes in the vital metrics for entity types in your environment. Leverage this view to monitor the health of your overall system and quickly understand the availability and performance of your server infrastructure. Use the dashboard to view the alert severity and impacted entities. To group related alerts into episodes, upgrade to IT Service Intelligence (ITSI).

The Alerts Review page includes the following sections:

Column Name	Description
Severity	The threshold severity level configured for the vital metric alert. The severity status changes when the vital metric crosses specific threshold values. The threshold severity levels are: Critical Warning Normal
Title	The title for the vital metric alert.
Involved Entity	The specific entity associated with the alert.
Time	The time that an alert was created.
Description	Details about the vital metric alert.

You can drill down to the individual entity details by clicking View Details.

Vital metrics for entity types

Vital metrics are statistical calculations based on SPL searches that represent the overall health of entities of that type. Vital metrics can search against both metrics and logs data, while the search result must be a metric. Entity types define how to classify a type of data source. To learn more about entity types, see Overview of entity types in ITSI.

In the following example, the entity type's vital metrics are average CPU usage, memory usage, disk availability, and network usage:

Perform the following steps to access the vital metrics for an entity type:

1. From the ITE Work main menu, click Infrastructure Overview.
2. In the Group by dropdown, choose Entity Type.
3. Select the card for the entity type you want to analyze.

The vital metrics for all entity types are defined in itsi_entity_type.conf. One vital metric contains "is_key": 1 which designates it as the key statistic displayed in the Infrastructure Overview histogram.

The vital metrics search of each of the default entity types uses a macro like itsi_entity_type_nix_metrics_indexes to find data. If the entity type histogram or vital metrics shows no data, it's possible that the data resides in another index. If this is the case, modify the macro to include your index.

Configure vital metric alerts

You can configure alerts that generate notable events when vital metrics cross your established thresholds. Perform the following steps to configure vital metric alerts for default entity types:

1. From the ITE Work main menu, click Configuration > Entities.
2. Click Entity Types.
3. Click Edit on the entity type you want to edit.
4. Expand the Vital Metrics (optional) section and select the vital metric that you want to create an alert for. The alert will be applied to all entities categorized under the entity type that you create the alert for.
5. In the Alerting section, click Add Alert. The alert is enabled by default.
6. In the alert window, set the alert schedule, a time to suppress the alert after it is fired, and alert thresholds for the vital metric.
7. Set up trigger conditions for the thresholds. The Critical threshold is required. You can adjust this threshold value, but the threshold cannot be deleted.
1. (Optional) Click Add a threshold level to create a Warning threshold.
2. For the If metric is field, select greater than or less than to set the threshold hierarchy. If you select greater than, the Critical threshold is a maximum threshold. If you select less than, the Critical threshold is a minimum threshold.
8. Click Save.
9. After configuring a vital metric alert, a new saved search is created in savedsearches.conf. When you remove an alert, the saved search will be deleted.