Alerts
In AppResponse 11 when an event on your network violates a policy you configured, an alert is triggered. You can view alerts and their details using the Alerts submenu under Insights in the web UI.
Two alert Insights are available:
◼ Alert Events—A list by alert ID of all or selected policies that took place in the time interval chosen or specified.
◼ Alert Event Details—An event summary for a specified alert ID. This includes the policy, severity, duration, and policy trigger conditions.
This section covers the following topics:
Disabling alerts suspends the alert mechanism. When alerts are disabled, AppResponse 11 continues tracking trigger criteria, as it does when alerts are enabled, but abstains from sending an alert unless or until alerting is re-enabled. If alerting is re-enabled, alerts are sent according to the trigger criteria that were tracked while alerting was suspended.
Viewing Alert Events
You can choose or specify a time interval and view alerts for all policies or a selected policy in that time interval.
To view alert events:
1. Go to Insights > Alerts: Alert Events
2. On the Inputs tab, specify the following:
– Policy Type—AppResponse 11 supports Traffic policies only.
– Name—To view alerts for all policies, leave this field blank. To view alerts for a specific policy, click in the text box and select the policy from the displayed list or enter the policy name.
3. Set or clear the Show Ongoing Only check box to see only ongoing alerts.
4. Click Launch. A table listing the alerts by alert ID is displayed.
To display other alerts you can:
◼ change the time interval.
◼ click the expand icon next to Inputs at the top of the page and repeat steps 2 through 4 above.
There is an Alert Events tab provided in the Host Groups, IPs, and Server IPs Insights, enabling you to view relevant alert events without leaving those Insights.
Alert Events Table
Based on the inputs provided, AppResponse 11 displays a list of alerts by alert ID. The table can be modified in the following ways:
◼ The table can be sorted using any column heading by clicking the up or down arrowhead icons to the right of a column heading.
◼ To change the columns that are displayed, click the More icon, then click Open Column Chooser. This displays the Column Chooser dialog, enabling you to modify the set of columns shown in the table.
◼ The number of rows displayed can be set in the bottom-right corner of a large table.
◼ To change a table’s time interval, use the table toolbar in the upper-right corner of the page.
– Select a predefined current time interval (15m, 1h, 1d, 1w, 1m) or click the pencil or in the displayed time interval to specify the time interval in units of one minute or greater.
◼ To display the table on a single page, hover over the top-right corner of the table and click the settings icon (gear).
– In the Edit Widget window, click Appearance in the left column, then clear the Enable Pagination check box.
◼ To add a title to the table, hover over the top-right corner of the table and click the settings icon (gear).
– In the Edit Widget window, click Appearance in the left column, then specify a title in the Widget Title text box.
◼ To view the Alert Event Details for a table row, click the ID in the first column. The Alert Event Details page for that alert ID then opens.
Monitoring Alerts Using the Alert Events Page
The table toolbar has a check box to enable or disable Auto-Update of the table’s contents. The update cycle (in minutes) can be set by clicking the expand icon to the right of Auto-Update. Specify the desired update cycle in minutes, the press Enter. A countdown icon appears to the right of Auto-Update when it is enabled, indicating the status of the next update.
Saving an Alert Events Page
An Alert Events page can be saved as an Insight in two different formats:
◼ Insight—Insights you create can be revised and renamed in the Navigator workspace.
◼ Snapshot—A Snapshot is a one-time image of a chart’s contents.
To save an Alert Events page:
1. Click the disk icon at the end of the table toolbar to open the Save Insight as window.
2. The Name and Description fields can be modified as needed. If the name is already used by an Insight a new name must be used.
3. Tags are a comma-separated list. New tags can be added and existing tags can be modified or deleted.
4. Select the access to the Insight.
– Public or Private access allows the Insight to be used by anyone or only yourself.
– Shared access is granted by role. You select read-only or read/write access for each role.
5. Select the format to be saved in.
– Insight
– Snapshot
6. Click OK to save or Revert to discard your changes. To cancel, click the X in the top-right corner of the window.