Event Status

Edit online

Use the Event Status to get a summary overview of open events for the selected navigator item and to respond to events with a critical or warning status by drilling down to detailed dashboards.

The status indicators are for events from the thresholds that are running on your managed systems. If you have Hybrid Gateways configured, the events can also be from situations that are running on the managed systems in your IBM® Tivoli® Monitoring environment. If your configuration includes IBM Operations Analytics - Predictive Insights, any detected anomalies are also displayed.

Events for some thresholds do not display in the Application Performance Dashboard. The thresholds use attributes for resources that are not published, which can occur in agents that support subnodes. (For a description of subnodes, see the Agent Builder topic, Using subnodes ).

Critical, Warning, Normal
  • The status indicators consolidate the event severities from the thresholds:
    • Critical status indicates all events with a Fatal or Critical severity
    • Warning status indicates all events with a Minor or Warning severity
    • Normal status indicates all events with an Unknown severity
    Unknown status indicates that the managed system is offline. After 4 days offline, the managed system is removed from any applications and no longer is displayed in the dashboards.
    To check the status, stop, or start an agent, see Using agent commands
    To change the time to wait before an offline managed system is removed, see the Remove Offline System Delay option in Agent Subscription Facility
  • Tivoli Monitoring Versions 6 and 7 When one or more Hybrid Gateways are configured, the status indicators for events from Tivoli Monitoring situations are the same as for thresholds except that Normal status indicates events with Harmless, Informational, or Unknown severity.
  • When your managed environment includes IBM Operations Analytics - Predictive Insights, any detected anomalies are indicated by a diamond-shaped icon over the status indicator, such as Warning status with anomaly icon. For more information, see Investigating anomalies with Operations Analytics - Predictive Insights.
Event Severity Summary percentage gauge
  • The Event Severity Summary gauge shows the Critical, Warning, and Normal event status percentages. For example, Event Severity Summary gauge shows that 50% of events are from thresholds with a Minor or Warning severity and 50% are from thresholds with a Fatal or Critical severity.
  • Also reported is the total number of events and how many for each status level.
  • The event count includes any anomalies from Operations Analytics - Predictive Insights. For example, a total of 8 including 1 anomaly means that there are 7 threshold events and 1 anomaly event.
Events table
  • The table of open events and status is defined by the selected navigator item: application, group, subgroup, or instance.
  • Events are sorted by the Severity column, with the highest severity shown first. Click a column heading to change the sort order.
  • Each row provides the following information about the event:
    Threshold Name
    The name that was given to the threshold.
    Tivoli Monitoring Versions 6 and 7 The name that was given to the situation.
    Status
    The status of the event, such as Open.
    Severity
    The severity value of the event: Critical (applies to Fatal and Critical threshold severities), Warning (applies to Minor and Warning threshold severities), or Normal (applies to Unknown threshold severities; for Tivoli Monitoring events, applies to Harmless, Informational, and Unknown severities).
    Unknown status indicates that the managed system is offline. After 4 days offline, the managed system is removed from any applications and no longer is displayed in the dashboards. (To check status, stop, and start an agent, see Using agent commands.)

    When your managed environment includes IBM Operations Analytics - Predictive Insights, analytics applied to the historical data might detect an anomaly and open an event. An event opened for a detected anomaly is indicated by an icon overlaying the status indicator, such as Critical status with anomaly icon. Click the View anomaly analysis link to open the Predictive Insights Service Diagnosis view in a new browser tab or window. Use the Service Diagnosis view to review the anomalous behavior in the components that support the application.

    Display Item
    Applies to multiple-row data sets only. The display item is a key attribute that was selected for the threshold to distinguish multiple events from one another that were opened for the same managed system.
    Source
    The system host name or other name that is derived from the monitoring agent that identifies the source of the event.
    Timestamp
    The date and time when the event occurred or the condition was observed by the originating agent, expressed in the time zone of the Cloud APM console user.

    If an agent is restarted or threshold definitions are modified for an agent, then the agent's sampled events are closed and reopened if the threshold condition is still true. In these scenarios, the Timestamp value is updated to the time when the originating agent reopened the event.

    For pure events, a new event is opened by the agent and replaces the previous event instance each time the originating agent determines that the threshold condition is true. A pure event remains open for 24 hours (or a configurable number of hours) after the last time the threshold condition evaluated to true. Only the latest instance of a pure event is displayed on the Cloud APM console.

    Description
    The description, if any, that was written for the threshold.
  • Click a row to expand the details about the event:
    Node
    The managed system name of the node instance.
    For agents with subnodes, the Enable Subnode Events option controls whether subnodes are shown. For more information, see UI Integration.
    Threshold ID
    The threshold identifier.
    Global Timestamp
    The date and time when the event was received from the originating agent by the Cloud APM server, expressed in the time zone of the Cloud APM console user.
    Type
    Whether the event is pure or sampled. Pure events are unsolicited notifications. Thresholds for pure events have no sampling interval or constant metric that can be monitored for current values.
    Description
    The description, if any, that was written for the threshold.
    Formula
    The formula as it is written in the Threshold Editor. For example, Percent Failed > 10.000 AND Transaction Definition Name != 'Ignore_Resources'.

    IBM Cloud Application Performance Management 8.1.4.0 Interim Fix 3 Server Patch or later (on Fix Central): If the EIF Slot Customization function was used to customize the value of the msg base slot, the customized msg slot value is displayed instead of the threshold formula. For more information, see Forward EIF Event? in the Threshold Manager topic and Customizing an event to forward to an EIF receiver.

    You can select and expand other rows, or click again to collapse a row. While a row is expanded, you can drill down to the dashboards for the managed system that you can use to help determine the cause of the event.