What are alarm thresholds?

Escalation and de-escalation thresholds

For alarms that occur repeatedly, you can set thresholds in an alarm policy to escalate and de-escalate the severity of the alarm; see How do I configure alarm policies?. Escalation to a higher severity can alert you to a problem when an alarm is occurring too often, or occurs too many times. De-escalation restores a lower level of severity when the alarm occurs less often. Configured thresholds are applied immediately once the updated policy is saved.

You can set more than one escalation threshold and de-escalation threshold in a policy, so severity for a particular alarm type can be increased or decreased more than once if required.

You can configure any higher severity level for escalation, and any lower level for de-escalation; it doesn’t have to be an adjacent severity level.

Figure 21-1, Alarm escalation without de-escalation shows how an escalation policy will increase the severity setting of an alarm based on a specified frequency threshold. The severity is increased twice: from minor to major, and then from major to critical, based on two threshold values for the Frequency parameter. In this case, no de-escalation threshold is applied, so the alarm remains at critical severity even when the frequency falls below the threshold again.

Figure 21-1: Alarm escalation without de-escalation

Note: When no de-escalation policy is applied, escalated alarms are not de-escalated once the frequency of the alarm is less than the alarm escalation threshold.

Figure 21-2, Alarm escalation and de-escalation shows changes in alarm severity when both escalation and de-escalation frequency thresholds are applied. An alarm reaches two configured frequency thresholds and is escalated twice: from minor to major, and from major to critical. Then, when the frequency reaches the specified values for de-escalation, the alarm severity is reduced again.

Figure 21-2: Alarm escalation and de-escalation

Escalation thresholds can be based on frequency of occurrence of an alarm, or total number of occurrences, or both.

• The Frequency threshold is the number of times an alarm occurs within a specified interval. The default interval for an alarm policy is 24 hours, but you can modify this using the Interval parameter on the Specific Alarm Policy form. The NFM-P uses an internal mechanism to assess the frequency threshold each time the alarm occurs, so it is not necessary to wait for the full interval to elapse before escalation/de-escalation is triggered.

• The Occurrence threshold is the total number of occurrences of the alarm since the policy was applied; that is, since the default value of zero for the Occurrence parameter was changed for the policy. When the total number of occurrences of an alarm reaches this threshold, the alarm is escalated to the configured severity.

  If the Occurrence threshold is deleted from a policy, existing alarms remain at their escalated severity. However, the next occurrence and all subsequent occurrences will show the severity configured in the Initial Severity Assignment (unless they reach another configured threshold).

Frequency and Occurrence thresholds are independent of each other; the alarm is escalated when either of the thresholds is reached. At least one of the thresholds (Frequency or Occurrence) must be set to a value other than zero for escalation to occur. If a value is set to zero then that threshold is ignored and no escalation occurs for that threshold.

De-escalation thresholds are based only on frequency. If the Frequency parameter is set to zero then the threshold is ignored for frequency changes and no de-escalation occurs.

You must enable the Escalation and De-Escalation check boxes on the Specific Alarm Policy form for their associated thresholds to be applied.

Additionally, policy-based escalation and de-escalation is controlled on the Alarm Settings form, General tab. You must enable the Allow Policy Based Escalation and Allow Policy Based De-escalation parameters in the Alarm Severity Settings panel, in the Automatic sub-panel; see How do I configure alarm severity and deletion behavior?.

Acknowledging an alarm does not affect escalation policies. Deleting an alarm affects the frequency counter; see How do I configure alarm severity and deletion behavior?.

Escalation policies are affected by the Auto Deletion Rule parameter of the global alarm deletion policy. See How do I configure alarm severity and deletion behavior? for more information. When an escalation policy uses the “Delete Alarms when Cleared” default option for the Automatic Alarm Deletion Settings parameter, the escalation policy is not applied, unless alarm debouncing is enabled for the particular alarm type. You must configure the parameter to a value other than “Delete Alarms when Cleared” to ensure that the escalation policy is applied.