Defining Escalation Routes 
By default the only response to an alert operator message is Acknowledge. This can be changed on the alert source.
Alert operator messages are created by alert sources. Each alert source uses specific rules to determine:
when an alert needs to be raised
the escalation to use
the message to send
the valid replies
Alert escalations define where alerts are sent, and how long to wait for an acknowledgment before continuing to the next stage of the escalation.
Each alert escalation has the following fields:
Address - where the escalation message is to be sent.
Default Alert Escalation - the next escalation to use.
Delay amount and units - how long to wait for acknowledgment before the next escalation.
The message is sent to the specified address the moment the escalation is raised. If a default alert escalation is specified, then it will be raised after the delay specified on the current escalation.
Caution
It is possible to create loops in escalation to repeatedly send messages. We recommend you add a delay of at least one minute between escalations to avoid overloading your mail server or clients.
Alert escalations support the following actions:
Action |
Description |
Export |
Export the alert escalation into a CAR file |
Edit |
Edit the alert escalation |
Edit Security |
Edit the security of the alert escalation |
Delete |
Delete the alert escalation |
Duplicate |
Make a copy of the alert escalation to create a similar one |
Expand All |
Expand all alert escalations in the current filter |
New |
Create a new alert escalation |
Filter > New Filter |
Create a new alert escalation filter |
Filter > Edit Filter |
Edit current alert escalation filter |
Filter > Delete |
Delete current alert escalation filter |
You can search for alert escalations using filters and the Search Alert Escalations box on the Alert Escalations tab. This box is known as the intelliSearch box and located under your username on the top right-hand side of the user interface. Filters allow you to specify a list of objects with static criteria. IntelliSearch allows you to specify complex queries in a simple way using prefixes. Prefixes are used to specify which property you are searching in and have short and long syntaxes. For example, if you want to display all alert escalations with the term management in the comment, you would use the search criteria as follows:
c:management
You can search more than one property, as follows:
c:management n:corp
Note
No spaces should be entered before or after the colon (:).
See the Advanced Object Search for more information.
The following table illustrates the available prefixes for alert escalations:
Prefixes |
Description |
n, name |
searches the name property |
c, com, comment |
searches the comment property |
d, desc, description |
searches the description property |
a, app, application |
searches the application property |
You can only delete alert escalation when no other objects relate to them. For example, if there are job definition alert sources that use the escalation, the escalation cannot be deleted until all job definition alert sources that use it have been modified. You can see all job definition alert sources that relate to the escalation in Related Objects in the lower detail pane and on the show page.
The table in related objects contains three columns:
Type - the type of object with a link to it
Related Object - the name of the object with a link to it
Used As - objects can sometimes be used in different roles
Privilege |
Description |
AlertEscalation.Create |
Create alert escalations |
AlertEscalation.Delete |
Delete alert escalations |
AlertEscalation.Edit |
Edit alert escalations |
AlertEscalation.View |
Access alert escalations |
You can grant privileges on two levels, Access and Admin; a privilege granted on Admin level allows the grantee to grant the privilege to other users. These privileges can be granted system-wide, per partition or isolation group.
If you have the security module, which requires the Module.Security license key, you have an additional Security tab on the alert escalation. It allows you to specify which users can access, edit, and delete the alert escalation.
Create a simple alert escalation
Navigate to .
Choose New from the context menu.
Fill the Name field, the Address field, and Delay field.
Choose Save & Close.
Simple three stage escalation
Navigate to .
Choose New from the context menu.
Fill StageOne in the Name field, duty-operator@masalan.com into the Address field, and 15 into the Delay field, leave the Unit drop-down on Minutes.
Repeat the previous two steps to create two more with the data below.
Choose Save & Close.
Name - StageTwo
Address - backup-operator@company.com
Default - StageThree
Delay - 10 Minutes
Name - StageThree
Address - it-manager@company.com
Default - none
Delay - ignored
Three stage escalation with loop
Navigate to .
Choose New from the context menu.
Fill StageOne in the Name field, duty-operator@masalan.com into the ''Address' field, and 15 into the Delay field, leave the Unit drop-down on Minutes.
Repeat the previous two steps to create two more with the data below.
Choose Save & Close.
Name - StageTwo
Address - backup-operator@company.com
Default - StageThree
Delay - 10 Minutes
Name - StageThree
Address - it-manager@company.com
Default - StageThree
Delay - 5 Minutes
Result
Procedure 1:
If an alert is raised at 20:00 and escalated to StageOne, the following will happen:
20:00 - An email will be sent to duty-operator@company.com. If no response is received after 15 minutes, then it will be escalated to StageTwo.
20:15 - An email will be sent to backup-operator@company.com. If no response is received after 10 minutes, then it will be escalated to StageThree.
20:25 - An email will be sent to it-manager@company.com.
Procedure 2:
If an alert is raised at 20:00 and escalated to StageOne, the following will happen:
20:00 - An email will be sent to duty-operator@company.com. If no response is received after 15 minutes, then it will be escalated to StageTwo.
20:15 - An email will be sent to backup-operator@company.com. If no response is received after 10 minutes, then it will be escalated to StageThree.
20:25 - An email will be sent to it-manager@company.com. If no response is received after 5 minutes, then it will be escalated to StageThree.
20:30 - An email will be sent to it-manager@company.com. If no response is received after 5 minutes, then it will be escalated to StageThree.
Email will be continue to be sent to it-manager@company.com every 5 minutes until the operator message is acknowledged.