Monitoring alerts

Use the all new Alerts page to monitor, investigate, and resolve alerts.

About alert monitoring
Alert monitoring provides selected application, service, and network event information, together with groups of alerts brought together by intelligent underlying analytics, to help you see the information you need to perform effective troubleshoot and resolution activities.
Accessing alerts
Monitor alerts by accessing the Alerts page.
Changing datasource, filter, and view settings
To change the alerts and alert columns that you see in the table on the Alerts page, change datasource, filter, and view settings. You can also sort on multiple columns.
Displaying the alert side panel
Click any alert to display a side panel containing more information about that alert.
Displaying alert details
The Alerts page displays the most important columns that are associated with an alert. Click any alert to display a full set of columns for that alert in the sidebar.
Working with the alert timeline
Click any alert to display a timeline for that alert in the sidebar. The timeline includes journal entries for the alert, and comments added by operators, in chronological order.
Displaying alert seasonality
Alerts can occur within a seasonal time window. For example, an alert might tend to occur on a certain day of the week or a certain time of the day. Alerts that tend to occur within a seasonal time window are highlighted on the Alerts page using a large dot in the alert's Seasonal column. Click the dot to find out when the alert tends to occur.
Displaying alert topology
If the resource on which an alert occurred can be located in the network topology system, then a large dot is presented in the alert's Topology column. Click the large dot to display a topology map for this alert, centered on the resource on which the alert occurred.
Searching alerts
You can search the list of alerts based on data contained within the alert columns. For example, type london in the search box to filter the list to display only those alerts where one or more the alert columns contains the string "london".
Filtering alerts
You can filter the list of alerts based on severity, enrichment, and grouping.
Troubleshooting alerts
You can troubleshoot alerts by running predefined actions on an alert, including administrative actions such as acknowledging an alert and creating a ticket based on an alert, and information retrieval actions, such as running ping or traceroute commands against the resource on which the alert occurred.
Creating incidents
You can manually create Netcool Operations Insight incidents from one or more alerts.
Executing a runbook
A runbook is a set of predefined actions that are meant to resolve a fault condition associated with an alert. For example, a Memory utilization 100% alert might have an associated runbook that automatically restarts the resource associated with that alert. If a runbook has been set up for a specific alert, then you will see a large dot in the alert's Runbook column. Click the dot to open the alert sidebar, from where you can launch the runbook.
Displaying an alert group
Expand an alert group to display the alerts that were correlated together within the group.
Displaying probable cause for an alert group
When you expand an alert group, you will see the probable cause ratings for each alert in the group. The alert with the greatest probable cause rating is the most likely cause of these alerts.
Displaying analytics details for an alert group
To understand why these alerts were grouped together, click the option to show group details. This option displays the underlying temporal, topological, and scope-based groups that were brought together to form this alert group.
Displaying metric details for an alert
This task describes how to view an alert's metric information obtained by the metric anomaly detection capability.
Using Metric search to create a timeseries chart
Visualize a KPI, with or without an anomaly, in a timeseries chart.

Parent topic: Resolving alerts