Alerts and events
You can use XClarity One to monitor the alert and event history of your managed devices.
You can monitor active alert and event metrics by clicking Monitor in the context menu from the Device management view. You can then view a list of active alerts and events by clicking the appropriate panel title.
To learn how to resolve a specific alert or event, go to the Alerts or Events page and click Show details beneath the alert or event description.
Active alerts
Alerts are events that represent a problem that requires investigation and user action.
Alerts exist only while they are active. When an alert is raised (asserted), an identical event is added to the event log. When the problem is resolved, the alert is automatically dismissed (de-asserted) and an event is added to the event log that states that the problem no longer exists.
The management hub sends new active alerts to the XClarity One portal as soon as they are raised and removes alerts in XClarity One portal as soon as they are resolved. XClarity One also synchronizes alerts with the hubs every six hours to ensure consistency.
If alerts cannot be forwarded (such as when connectivity is down), the hub stores alerts until they can be pushed successfully, for up to 24 hours. If connectivity is down for more than 24 hours, only the last 24 hours of alerts are pushed when connectivity is restored.
Events
XClarity One stores a historical list of all resource and audit events in a single events log. A maximum of 10,000 events are store for each organization. When the maximum number of events is reached, the oldest event is discarded when the next event is received.
Resource events
A resource event identifies a condition that occurred on a managed device, hub, or XClarity One that is not related to direct user action (for example, a connectivity issue between a device and the hub). You can use these events to track and analyze hardware and management related issues.
Audit events
An audit event is a record of user activities that were performed from a hub or XClarity One (such as a user performing a power action on a device). Each audit event includes the username (email address) and IP address of the user that performed the action. You can use these audit events to track and analyze authentication-related issues and user activity.
NoteWhen a user initiates an action that is performed by the hub, the audit event shows the hub username as (XC1_MGR_*) instead of theXClarity One username.
The hub sends events to the XClarity One portal as soon as they are raised. XClarity One also synchronizes alerts with the hubs every six hours to ensure consistency.
If events cannot be forwarded (such as when connectivity is down), the hub stores events until they can be pushed successfully, for up to 24 hours. If connectivity is down for more than 24 hours, only the last 24 hours of events are pushed when connectivity is restored.
Metrics and trends
The Alerts panel and Events panel summarize the data about active alerts and events that were raised by managed devices, including the following data.
A circular graph representing the percent of alerts/events by severity (critical and warning). Hover over each colored bar in the graph to see the total number of alerts/events for the specific severity.
Total number of alerts/events by severity. Click a number to open the Alerts page or Events page with a list of all alerts/events in that severity.
A line graph representing the number of alerts/events, over time in the last month. Hover over each colored bar in the graph to see the number of alerts/events by severity.
Total number of alerts/events, by severity, during last month and during the last year.
Dismissing alerts
You can dismiss specific active alerts that are not relevant to you and do not require any action to resolve. Dismissed alerts are hidden from all Alerts table and are excluded from device health summaries and alert statistics, and associated events are not forwarded to external services through data forwarders.
You can create a rule to dismiss both currently active alerts as well as those occurring in the future, optionally up to a specified date. You can choose to dismiss either all instances of the alert that were generated by the specific device or by any devices.
To dismiss alerts, click Monitor in the context menu from the Device management view, click Alerts, select an alert, and click the Dismiss alert (
) icon. Follow the instructions in the wizard to complete the process.
To see dismissed alerts in the Alerts tables, filter on the Status=Dismissed.
To restore a dismissed alert, either select the alert and click the Restore alert (
) icon on the toolbar, or remove the alert dismissal rule. Restored alerts will reappear in the Alerts table and will be included in device health summaries and alert statistics.