POST /api/v1/customAlerts/rules

Use this method to create a custom alert rule for raising custom analytics alerts.

Note

This REST API requires Lenovo XClarity Orchestrator v1.3 or later.

Authentication

Authentication with username and password is required.

Resource URI

POST https://{management_server_IP>/api/v1/customAlerts/rules

Query parameters

None

Request body

Table 1. Event-based alert rules.
Attributes		Required / Optional	Type	Description
alertDescription		Optional	String	Additional information to clarify the reason for the alert
alertMsg		Required	String	Message string for the alert
alertUserAction		Optional	String	User actions that can be taken to recover from the alert
eventCode		Required	String	Event code that uniquely identifies the alert and event When an alert is raised based on a custom alert rule, an event is also raised. The same event code is used for both the active alert and the event using the format `FQXXOCAxxxxc`, where `xxxx` is the unique identifier and `c` is the severity.
criteria		Required	Object	Criteria for raising an alert
	count	Required	Integer	Number of times that the event must occur in the specified interval before an alert is raised
	eventID	Required	String	ID of the event that triggers an alert To obtain a list of event IDs, see Event and alert messages.
	interval	Required	Integer	Period of time, in minutes, in which the event occurs before an alert is raised
	mode	Required	String	Indicates whether the rule applies to a device or device group. This can be one of the following values. device. Raises an alert when the event occurs on any device. The device name is included in this alert. group. Raises an alert when the event occurs on a device in any device group. The group name is included in the alert.
description		Optional	String	Rule description
name		Required	String	Rule name
severityKey		Required	String	Alert severity key. This can be one of the following values. Warning. User can decide if action is needed. Critical. Action is needed immediately, and the scope is broad (perhaps an imminent outage to a critical resource will result).
statusKey		Required	String	Rule status key. This can be one of the following values. enabled (default) disabled
typeKey		Required	String	Rule type key. For event-based alert rules, this is always event.

The following example creates an event-based rule that raises an alert when server management fails 5 times in a 24-hour period.

{
   "alertDescription": "",
   "alertMsg": "",
   "alertUserAction": "",
   "eventCode": "FQXXOCA0001J",
   "criteria": {
      "count": 5, 
      "eventID": "FQXHMDI0107G", 
      "interval": 1440, 
      "mode": "device"
   },
   "description": "Server management fails 5 times in a 24-hour period",
   "enabled": true,
   "name": "Server managment failures",
   "severityKey": "Warning", 
   "statusKey": "enabled",
   "typeKey": "event"
}

Table 2. Metric-based alert rules.
Attributes		Required / Optional	Type	Description
alertDescription		Optional	String	Additional information to clarify the reason for the alert
alertMsg		Required	String	Message string for the alert
alertUserAction		Optional	String	User actions that can be taken to recover from the alert
eventCode		Required	String	Four-digit number that uniquely identifies the alert and event When an alert is raised based on a custom alert rule, an event is also raised. The same event code is used for both the active alert and the event using the format `FQXXOCAxxxxc`, where `xxxx` is the four-digit unique identifier and `c` is the severity.
criteria		Required	Object	Criteria for raising an alert
	operator	Required	String	Comparison operator to use when comparing the value of metric against the specified threshold. This can be one of the following values. gt. Greater than gte. Greater than or equal to lte. Less than or equal to lt. Less than
	count	Required when mode is count	Integer	(Count mode only) Minimum amount of time, in seconds, that the limit is breached before an alert is raised
	interval	Required when mode is average or count	Integer	(Average and count modes only) Period of time, in seconds, in which the measurement is evaluated
	threshold	Required	Integer	Threshold to be met for raising an alert
	metric	Required	String	Metric for which the value is to be evaluated To obtain a list of metrics, use GET /customAlerts/metrics.
	mode	Required	String	Criteria mode. This can be one of the following values. average. Raises an alert when the average value of the metric breaches the threshold (based on the comparator) during a specific interval. For example, you can create a rule to raise an alert when the average CPU Temperature (metric) during a 24-hour period (interval) is greater than (operator) 40 degrees C (threshold). count. Raises an alert when the metric breaches the threshold (based on the comparator) a certain number of times during a specific interval. For example, you can create a rule to raise an alert when the CPU Temperature (metric) is greater than (operator) 40 degrees C (threshold) for 5 times (count) in a 24-hour period (interval). simple. Raises an alert when the metric breaches the threshold (based on the comparator). For example, you can create a rule to raise an alert when the CPU Temperature (metric) is greater than (operator) 40 degrees C (threshold).
description		Optional	String	Rule description
name		Required	String	Rule name
severityKey		Required	String	Severity key. This can be one of the following values. Warning. User can decide if action is needed. Critical. Action is needed immediately, and the scope is broad (perhaps an imminent outage to a critical resource will result).
statusKey		Required	String	Rule status key. This can be one of the following values. enabled (default) disabled
typeKey		Required	String	Rule type key. For metric-based alert rules, this is always metric.

The following example creates a metric-based rule that raises the CPU Temperature of any device exceeds 40 degrees C for 5 times within a 24-hour period.

{
   "alertDescription": "",
   "alertMsg": "",
   "alertUserAction": "",
   "id": "046b6c7fс0b8ac43b9db35dd6489e6daee91",
   "eventCode": "FQXXOCA0002J",
   "criteria": {
      "operator": "gt", 
      "count": 5, 
      "interval": 1440, 
      "threshold": 5, 
      "metric": "CPUTemp", 
      "mode": "count"
   },
   "description": "CPU Temperature greater than 40 C for 5 times in 24-hours",
   "name": "High CPU temperatures",
   "severityKey": " Warning ", 
   "statusKey": " enabled ",
   "typeKey": "metric"
}

Response codes

Code	Description	Comments
200	OK	The request completed successfully.
400	Bad Request	A query parameter or request attribute is missing or not valid, or the operation is not supported. A descriptive error message is returned in the response body.

Response header

The URL of the custom analytics alert is returned in the Location field.

Response body

Attributes			Type	Description
`{message_attributes}`			`varies`	Status messages (see Status messages)

Give documentation feedback

POST /api/v1/customAlerts/rules

Authentication​

Resource URI​

Query parameters​

Request body​

Response codes​

Response header​

Response body​