Avalon Alert Monitor

The Avalon Lancelot suite provides real-time statistical and trend data allowing IT staff to monitor and manage IP traffic and to maintain the efficiency and health of infrastructure, system and applications. It can generate alerts when one of the aspects crosses a threshold (defined in the Avalon Lancelot console). The Avalon Alert Monitor allows you to integrate these alerts into the Topaz system, eliminating the need to check manually for the alerts.

Usage Guidelines

What to monitor

The Avalon Alert Monitor is useful for forwarding alerts generated by the Lancelot network monitoring suite to Topaz applications. The Lancelot suite provides real-time statistical and trend data allowing IT staff to monitor and manage IP traffic and to maintain the efficiency and health of infrastructure, system and applications.

Each time an alert is generated by the Avalon Lancelot network management suite, it can be forwarded to Topaz using the SiteScope Avalon Alert Monitor. While receiving and forwarding alerts, SiteScope can log the alerts for you, eliminating the need to check for the alerts generated by the Avalon Lancelot manually. In addition, you can be notified of warning conditions that you might have otherwise been unaware of until something more serious happened. Each time that it runs this monitor, SiteScope checks alerts that have been received since the last time the monitor ran.

Setup Requirements

The following are requirements for using the Avalon Alert Monitor to forward alerts to Topaz:

The Avalon server needs to be configured to send traps to the SiteScope server.
Note: The SiteScope Avalon Alert Monitor receives alerts from Avalon Lancelot suite as SNMP Traps. For that purpose it must have sole access to UDP port 162 (this is SNMP Trap UDP port). If another application (including another instance of SiteScope, running, for example, as a process) uses this port, the Avalon Alert monitor will report an "Address in use" error while defining the monitor. However, the Avalon Alert Monitor can share this port with other SiteScope monitors that must receive SNMP traps.
SiteScope must be registered with a Topaz installation. The SiteScope must have a profile defined in the Topaz installation prior to enabling the registration in the SiteScope interface. In order to verify registration or to re-register SiteScope with the Topaz server, see the Topaz Server Registration page under SiteScope Preferences.

Completing the Avalon Alert Monitor Form

To display the Avalon Alert Monitor Form, either click the Edit link for an existing Avalon Alert Monitor in a monitor table, or click the add a Monitor link on a group's detail page and choose the "Add Avalon Alert Monitor" link.

Complete the items on the Avalon Alert Monitor Form as follows. When the required items are complete, click the Add Monitor button.

Run Alert

Choose the method for running alerts. If "for each Avalon Alert entry matched " is chosen, then the monitor triggers alerts for every matching entry found.

Note: When the Avalon Alert Monitor is run in the "for each Avalon Alert entry matched" alert method, the monitor will never report a status of error or warning, regardless of the results of the content match or even if the target SNMP Trap is not found.

If the "once, after all Avalon Alerts have been checked" method is chosen, then the monitor counts up the number of matches and triggers alerts based on the "Error If" and "Warning If" thresholds defined for the monitor in the Advanced Options section.

Update every

Enter how frequently the monitor should read the application SNMP Trap. The drop-down list to the right of the text box lets you specify time increments of seconds, minutes, hours, or days. You must specify a time increment of at least 15 seconds.

Title

Enter a name for this monitor. This name appears in the Name text box on the monitor table when you open the group's detail page. If you don't enter a name, a default name will be created.

Advanced Options

The Advanced Options section presents a number of ways to customize monitor behavior and display. Use this section to customize error and warning thresholds, disable the monitor, set monitor-to-monitor dependencies, customize display options, and enter other monitor specific settings required for special infrastructure environments. The options for this monitor type are described below. Complete the entries as needed and click the Add or Update button to save the settings.

Disable

Check this box to temporarily disable this monitor and any associated alerts. To enable the monitor again, clear the box.

Enable EMS Integration

Check this option to have all detected Avalon Alert events forwarded to Topaz.

EMS configuration file path

Enter the path to the EMS integration configuration file. The default location is: SiteScope\ems\Avalon\main.config.
For more information about format of the file see EMS Generic Alert Probe Configuration.

Verify Error

Check this box if you want SiteScope to automatically run this monitor again if it detects an error. When an error is detected, the monitor will immediately be scheduled to run again once.

Note: In order to change the run frequency of this monitor when an error is detected, use the Update every (on errors) option below.

Note: The status returned by the Verify Error run of the monitor will replace the status of the originally scheduled run that detected an error. This may cause the loss of important performance data if the data from the verify run is different than the initial error status.

Warning: Use of this option across many monitor instances may result in significant monitoring delays in the case that multiple monitors are rescheduled to verify errors at the same time.

Update Every (on error)

You use this option to set a new monitoring interval for monitors that have registered an error condition. For example, you may want SiteScope to monitor this item every 10 minutes normally, but as often as every 2 minutes if an error has been detected. Note that this increased scheduling will also affect the number of alerts generated by this monitor.

Schedule

By default, SiteScope monitors are enabled every day of the week. You may, however, schedule your monitors to run only on certain days or on a fixed schedule. Click the Edit schedule link to create or edit a monitor schedule. For more information about working with monitor schedules, see the section on Schedule Preferences for Monitoring.

Monitor Description

Enter additional information about this monitor. The Monitor Description can include HTML tags such as the <BR> <HR>, and <B> tags to control display format and style. The description will appear on the Monitor Detail page.

Report Description

Enter an optional description for this monitor that will make it easier to understand what the monitor does. For example, network traffic or main server response time. This description will be displayed on with each bar chart and graph in Management Reports and appended to the tool-tip displayed when you pass the mouse cursor over the status icon for this monitor on the monitor detail page.

Depends On

To make the running of this monitor dependent on the status of another monitor or monitor group, use the drop-down list to select the monitor on which this monitor is dependent. Select None to remove any dependency.

Depends Condition

If you choose to make the running of this monitor dependent on the status of another monitor, select the status condition that the other monitor or monitor group should have in order for the current monitor to run normally. The current monitor will be run normally as long as the monitor on which it depends reports the condition selected in this option.

List Order

By default, new monitors are listed last on the Monitor Detail page. You may use this drop-down list to choose a different placement for this monitor.

Error if

Set an error threshold for this monitor. The thresholds are used when the "Run Alerts: once, ..." option is chosen. By default, an error is signaled whenever there is one or more matching events. Select a comparison value from the list, and use the comparison operator list to specify an error threshold such as: >= (greater than or equal to), != (not equal to), or < (less than).

The available parameters for checking are:

matchCount > 0 (the default)
matches (number of matches)
lines (number of lines)
matches/min (number of matches per minute)
value (first specific value exists)
value2 (second specific value exists)
value3 (third specific value exists)
value4 (fourth specific value exists)

Warning if

Set the Warning threshold for this monitor. The default is to generate a warning if SiteScope is unable to read the SNMP Trap. The symbols in the comparison value drop-down list are the same as those for Error if.

Good if

The default is to mark the monitor as good if the SNMP Trap can be read and there are no matches.