KBI 220738 When Good Rules Go Bad

Version

Argent Extended Technology All

Date

2 September 2007

Summary

A brief article on important Rule features.

Technical Background

While Rule creation is generally a simple point-and-click process, over time even the best defined Rules can be modified beyond all definition.

After all, easily defined Rules are also easy to modify. Generally it is someone “just tweaking some settings” without considering the possible results. Being aware of the features below will greatly assist in keeping your optimal configuration.

  1. Do you want to report on the metric being gathered by a Windows Performance Rule? If so, make sure you tick the Save Performance Data To The Argent Predictor option.

  2. If you want to be alerted every time a Rule breaks – even if you have already been notified about that particular event – make sure to use the Post Event even if same event is still Outstanding option. If this option is left un-ticked, you will be alerted once per event detected (except, of course, for any escalation Alerts you may choose to configure).

  3. To generate service SLA Reports from Windows Service Rules, just use the Save Service Uptime data for Trend Analysis option.

  4. Instead of configuring a Windows Service Rule for each critical Windows service, you could try using the Alert if any Auto-Started Service is in Stopped Mode option.

  5. If false Alerts are being returned from your Relators, go back to basics and double-check the metric being defined in the Rule. You may not have changed anything, but someone else could have.
  6. In some Rules you can be alerted if Argent cannot access the monitored metric. For example, in the Argent SQL Monitor you can use the Rule is broken if failed to connect to SQL Server option. Keep in mind using this extensively can result in an “alarm storm” when a SQL Server goes down.

  7. When monitoring SNMP traps, you can include the details of the trap in your Alerts by using the Include The Description Of SNMP Monitor In Event Details option.