DPOD can publish alerts when certain predefined events occur, for example, when device CPU is over 80%
Terminology
Alert Query - the metadata that defines the alert parameters (for example, count all the system errors from the last 10 minutes)
Alert Execution - an execution of the alert query
Alert Publishing - when an alert returns positive results, it will be published to interested parties via email or syslog
Alert Query
Each query consists of a type, query period, an operator and a threshold.
DPOD supports 3 types of alerts queries:
Frequency - The condition will be met if there were X events in the checked time (for example, more than 5 system errors occurred in the last 10 minutes)
Flatline - The condition will be met if there is a value above a certain threshold (for example, Device CPU is above 80%)
Any - The condition will be met if any results are returned for the query (for example, a DataPower object is down)
In addition, you can define filters, so the query will run on specific devices, domains or services.
Alert Execution
An execution is one instance of the alert query, there are 3 ways to execute a query:
- Scheduled - Enabled queries can be scheduled to run on specific time (or on a fixed interval)
- Test Via the web console - Click the "Test" button in the Alerts Details Page for a one time only execution, use it for testing the query before scheduling it.
- Via the REST API - an alert can be executed remotely via the REST API (for example, with CURL), the REST API URL for each query can be found in the Alerts Details Page