Show TOC

Procedure documentationDefining Escalation Routes Locate this document in the navigation structure

 

By default the only response to an alert operator message is Acknowledge. This can be changed on the alert source.

Alert operator messages are created by alert sources. Each alert source uses specific rules to determine:

  • when an alert needs to be raised

  • the escalation to use

  • the message to send

  • the valid replies

Alert escalations define where alerts are sent, and how long to wait for an acknowledgment before continuing to the next stage of the escalation.

Each alert escalation has the following fields:

  • Address - where the escalation message is to be sent.

  • Default Alert Escalation - the next escalation to use.

  • Delay amount and units - how long to wait for acknowledgment before the next escalation.

The message is sent to the specified address the moment the escalation is raised. If a default alert escalation is specified, then it will be raised after the delay specified on the current escalation.

Caution Caution

It is possible to create loops in escalation to repeatedly send messages. We recommend you add a delay of at least one minute between escalations to avoid overloading your mail server or clients.

End of the caution.
Actions

Alert escalations support the following actions:

Action

Description

Export

Export the alert escalation into a CAR file

Edit

Edit the alert escalation

Edit Security

Edit the security of the alert escalation

Delete

Delete the alert escalation

Duplicate

Make a copy of the alert escalation to create a similar one

Expand All

Expand all alert escalations in the current filter

New

Create a new alert escalation

Filter > New Filter

Create a new alert escalation filter

Filter > Edit Filter

Edit current alert escalation filter

Filter > Delete

Delete current alert escalation filter

Finding Alert Escalations

You can search for alert escalations using filters and the Search Alert Escalations box on the Alert Escalations tab. This box is known as the intelliSearch box and located under your username on the top right-hand side of the user interface. Filters allow you to specify a list of objects with static criteria. IntelliSearch allows you to specify complex queries in a simple way using prefixes. Prefixes are used to specify which property you are searching in and have short and long syntaxes. For example, if you want to display all alert escalations with the term management in the comment, you would use the search criteria as follows:

c:management

You can search more than one property, as follows:

c:management n:corp

Note Note

No spaces should be entered before or after the colon (:).

End of the note.

See the Advanced Object Search for more information.

The following table illustrates the available prefixes for alert escalations:

Prefixes

Description

n, name

searches the name property

c, com, comment

searches the comment property

d, desc, description

searches the description property

a, app, application

searches the application property

Deleting Alert Escalations

You can only delete alert escalation when no other objects relate to them. For example, if there are job definition alert sources that use the escalation, the escalation cannot be deleted until all job definition alert sources that use it have been modified. You can see all job definition alert sources that relate to the escalation in Related Objects in the lower detail pane and on the show page.

The table in related objects contains three columns:

  • Type - the type of object with a link to it

  • Related Object - the name of the object with a link to it

  • Used As - objects can sometimes be used in different roles

Security

Privilege

Description

AlertEscalation.Create

Create alert escalations

AlertEscalation.Delete

Delete alert escalations

AlertEscalation.Edit

Edit alert escalations

AlertEscalation.View

Access alert escalations

You can grant privileges on two levels, Access and Admin; a privilege granted on Admin level allows the grantee to grant the privilege to other users. These privileges can be granted system-wide, per partition or isolation group.

If you have the security module, which requires the Module.Security license key, you have an additional Security tab on the alert escalation. It allows you to specify which users can access, edit, and delete the alert escalation.

Procedure

Create a simple alert escalation

  1. Navigate to   Alerting → Alert Escalations  .

  2. Choose New from the context menu.

  3. Fill the Name field, the Address field, and Delay field.

  4. Choose Save & Close.

Example

Simple three stage escalation

  1. Navigate to   Alerting → Alert Escalations  .

  2. Choose New from the context menu.

    1. Fill StageOne in the Name field, duty-operator@masalan.com into the Address field, and 15 into the Delay field, leave the Unit drop-down on Minutes.

    2. Repeat the previous two steps to create two more with the data below.

  3. Choose Save & Close.

  • Name - StageTwo

  • Address - backup-operator@company.com

  • Default - StageThree

  • Delay - 10 Minutes

  • Name - StageThree

  • Address - it-manager@company.com

  • Default - none

  • Delay - ignored

Three stage escalation with loop

  1. Navigate to   Alerting → Alert Escalations  .

  2. Choose New from the context menu.

    1. Fill StageOne in the Name field, duty-operator@masalan.com into the ''Address' field, and 15 into the Delay field, leave the Unit drop-down on Minutes.

    2. Repeat the previous two steps to create two more with the data below.

  3. Choose Save & Close.

  • Name - StageTwo

  • Address - backup-operator@company.com

  • Default - StageThree

  • Delay - 10 Minutes

  • Name - StageThree

  • Address - it-manager@company.com

  • Default - StageThree

  • Delay - 5 Minutes

Result

Procedure 1:

If an alert is raised at 20:00 and escalated to StageOne, the following will happen:

  • 20:00 - An email will be sent to duty-operator@company.com. If no response is received after 15 minutes, then it will be escalated to StageTwo.

  • 20:15 - An email will be sent to backup-operator@company.com. If no response is received after 10 minutes, then it will be escalated to StageThree.

  • 20:25 - An email will be sent to it-manager@company.com.

Procedure 2:

If an alert is raised at 20:00 and escalated to StageOne, the following will happen:

  • 20:00 - An email will be sent to duty-operator@company.com. If no response is received after 15 minutes, then it will be escalated to StageTwo.

  • 20:15 - An email will be sent to backup-operator@company.com. If no response is received after 10 minutes, then it will be escalated to StageThree.

  • 20:25 - An email will be sent to it-manager@company.com. If no response is received after 5 minutes, then it will be escalated to StageThree.

  • 20:30 - An email will be sent to it-manager@company.com. If no response is received after 5 minutes, then it will be escalated to StageThree.

  • Email will be continue to be sent to it-manager@company.com every 5 minutes until the operator message is acknowledged.