It was somewhat involved - but there was a couple of things a consulting engineer helped us with:
1. Classify the severity each of the Alarm Types for: Informational, Trivial, Minor, Major, or Critical
Java client: Configuration > Alarm Configuration
Example: High Traffic is severity MINOR, Worm Propagation is severity CRITICAL, etc...
(See Attachment: alarm-configuration)
2. Create Response Management Action Rules
Java Client: Configuration > Response Management
We defined three different action rules - one for CRITICAL alarms, one for MAJOR alarms, and one for all other severity
(In our case PRIORITY A EMAIL means CRITICAL, PRIORITY B EMAIL means MAJOR, PRIORITY C EMAIL C means everything else)
We created three separate action rules so we can turn off the action (email) depending on the severity - or send to a different recipient
(See Attachment: email-action-rules & email-action-priority-a-email)
3. Create Host Alarm Response Management Rule
Java Client: Configuration > Response Management
This is where you determine the severity of the alarm - and take action based upon the severity
We defined three different host alarm response rules - one for CRITICAL alarms, one for MAJOR alarms, and one for all other severity
(In our case PRIORITY ALARM: A means CRITICAL, PRIORITY ALARM: B means MAJOR, PRIORITY ALARM: C is everything else)
Again:
PRIORITY ALARM: A rules point to the PRIORITY A EMAIL action rule
PRIORITY ALARM: B rules point to the PRIORITY B EMAIL action rule
PRIORITY ALARM: C rules point to the PRIORITY C EMAIL action rule
In our case we only send emails for CRITICAL severity
(See Attachment: response-management)
The logic is a bit strange on host alarm rules - I have attached screenshots for each
See Attachments: priority-alarm-a, priority-alarm-b, priority-alarm-c)
Hope this helps!
Bob
