Monitor alerts

Portail ZAPP Monitoring receives alerts from your monitoring tools (Zabbix, Centreon, Prometheus, Datadog, Azure Monitor…), groups them and shows them in a single console. It does not replace these tools: it gathers what they report, links it to the CMDB and the Service Desk, and keeps a record of every decision.

The Service Desk → Monitoring menu entry opens the Alert console. It is reserved for the Monitoring operators, Monitoring administrators, Service Desk administrators and Administrators groups.

Alerts and events

A monitoring tool sends events: a problem appears, it is taken in hand, it goes away. Portail ZAPP groups into a single alert all the events from the same source that carry the same deduplication key. When the same problem repeats, the alert is not duplicated: its number of Occurrences, the date of its Last event and, if needed, its Severity go up. Its summary stays the one of the first event.

A resolved alert that triggers again within 30 minutes is reopened instead of creating a new one (the delay can be set by the administrator).

Severities are, from highest to lowest: Critical, Error, Warning, Information.

The alert console

By default the console shows Open and acknowledged alerts. Above the list, the Open, Acknowledged and Suppressed (noise) counters give the number of alerts in each status; click one to filter the list.

The Status, Minimum severity, Source and Search filters narrow the list. The search ignores case and accents.

The console updates in real time: the Live indicator confirms it. If it shows Offline, the list is still reloaded every minute.

Each row shows the severity, summary, source, host, number of occurrences, last event and status. Badges also show:

• the number of the Service Desk incident opened for this alert;
• In maintenance: the alert arrived during a maintenance window of its CI, so it opens no incident;
• Not linked to a CI: no CMDB item could be matched to the alert.

The Acknowledge (open alert) and Resolve (open, acknowledged or suppressed alert) buttons act directly from the list.

Major incident suggestion

When many different CIs carry a recent alert at the same time (by default, at least 10 CIs in 10 minutes), a banner appears at the top of the console: “N CIs affected in M min: consider declaring a major incident.” (with the number of affected CIs and the configured window), followed by the most affected incidents. The major incident is declared from the incident's page, in the Service Desk. This suggestion relies on a simple rule and uses no AI.

An alert's page

Click an alert to open its page. It shows:

• the Details: source, host, component, group, class, deduplication key, occurrences, first and last event, acknowledgement and resolution dates, suppression reason;
• the Linked CI, with a link to the CMDB, or “Not linked to a CI”;
• the linked Incident, with a link to the Service Desk;
• the Links to the source tool, if it sent any;
• the Timeline: every event received and every decision, with its author, date and reason — CI found or not, rule applied, incident opened or updated, notification sent, maintenance window…
• the Raw details sent by the tool, displayed as text.

The available actions depend on the status:

• Acknowledge: you take the alert in hand;
• Resolve: the problem is fixed;
• Suppress (noise): the alert is of no interest. The Reason is required. Later events of this alert are still counted.

When a processing rule opened an incident, the incident can be resolved automatically as soon as all its alerts are resolved; the requester then confirms the resolution as for any ticket.

AI assistance

If an AI provider is configured, the page of an alert linked to an incident offers two aids. The AI proposes, you decide.

• Find related alerts: looks among the active alerts on other CIs seen around this alert for those that probably share the same cause, with a justification. Attach to the incident attaches the proposed alert to this alert's incident. The correlation appears in the Correlations card, marked AI, and a note is added to the ticket. Undo the correlation puts the alert back in its previous state. A correlation never changes an alert's status.
• Summarize for the incident: drafts a Burst summary of the alerts. Review and correct it, then Add to the ticket adds it to the incident as an internal note.

When AI is disabled, the AI assistance card does not appear and no outside call is made. Everything else in monitoring works the same: intake, rules, incidents, notifications, maintenance windows. Correlations already made stay visible in the Correlations card and can still be undone.

Elsewhere in Portail ZAPP

• Ticket page: the Related alerts panel lists the alerts that opened or joined the incident, active alerts first. It is visible to Service Desk agents and to operators; the link to the alert page only appears for those who can open it.
• CI page, in the CMDB: the Related alerts panel shows the CI's alerts of the last 7 days.
• Dashboard: the Active alerts by severity, Filtered noise (7 days) and Noisiest CIs (7 days) widgets, reserved for monitoring operators. Each row opens the filtered console.

The other monitoring screens

The buttons at the top of the console lead to the other screens:

• Maintenance windows: for all console users (see “Plan maintenance windows”);
• Monitoring sources, Processing rules and CI matching: for monitoring administrators (see “Connect a monitoring tool” and “Automate alert processing”).