Updated on 2026-06-23 GMT+08:00

Handling an Aggregated Alarm

After an aggregated alarm is generated, you can quickly handle it and execute the response plans such as contingency plans, jobs, or scripts. After an aggregated alarm is generated, you can convert the aggregated alarm to an incident by referring to Converting an Alarm to an Incident. After the alarm is converted to an incident, an incident ticket is generated and the actual ticket number is displayed in the associated incident ticket number column.

Precautions

Only the assigned owner can handle an aggregated alarm, convert it to an incident, or clear it. Other users can only view related information.

Prerequisites

You have enabled the fault management package. For details about billing, see Billing Items.

Handling an Aggregated Alarm

  1. Log in to COC.
  2. In the navigation pane, choose Fault Management > Alarms.
  3. On the Alarms page, click Aggregated Alarms > Unhandled Alarms to view the alarm information.
  4. Locate the alarm to be handled and choose More > Handle in the Operation column.
  5. On the alarm handling page, set the task type.

    • If you select contingency plans, select the corresponding contingency plan. If there is no desired contingency plan, click Create. For details, see Creating a Contingency Plan.
      • If you select a document-based plan, you can view the name and description of the plan step and manually execute the contingency plan accordingly.
      • If you select an automated response plan, you need to set a contingency plan to be executed. For details about the remaining steps, see Executing a Script or Executing a Job based on the processing method (custom script/job or public script/job) of the automatic contingency plan.
    • If you select a script, perform the remaining steps by referring to Executing a Script.
    • If you select a job, perform the remaining steps by referring to Executing a Job.

  6. Click OK.

Converting an Alarm to an Incident

  1. Log in to COC.
  2. In the navigation pane, choose Fault Management > Alarms.
  3. On the Alarms page, click Aggregated Alarms > Unhandled Alarms to view the alarm information.
  4. In the alarm list, locate the alarm to be handled and click Convert Alarms to Incidents in the Operation column. The alarm-to-incident page is displayed on the right.
  5. On the alarm-to-incident page, set alarm-to-incident information by referring to Table 1.

    Table 1 Parameters for converting an alarm to an incident

    Parameter

    Description

    Enterprise Project

    Select an enterprise project.

    Fault Occurrence Time

    Enter the time when the fault occurs.

    Application

    Select a faulty application.

    Incident Level

    The options are P1, P2, P3, P4, and P5.

    P1 incidents are the most critical, while P5 incidents are the least severe.

    Service Interrupted

    The options are Yes and No.

    Incident Type

    Select an incident type.

    Incident

    Specify the incident name according to the naming rules.

    Description

    Describe the incident.

  6. Click OK.

    After the alarm is converted to an incident, you can view it in the incident list and handle it.

Clearing an Alarm

The system retains alarm data (including data on the Historical Alarms tab page) for 31 days. After this period, the data will be automatically deleted.

  1. Log in to COC.
  2. In the navigation pane, choose Fault Management > Alarms.
  3. On the Alarms page, click Aggregated Alarms > Unhandled Alarms to view the alarm information.
  4. In the alarm list, select the alarm to be cleared and click Clear in the Operation column.
  5. Set parameters for clearing alarms.

    Table 2 Parameters for clearing alarms

    Parameter

    Description

    Service Interrupted

    The options are Yes and No.

    Fault Occurrence Time

    This parameter is required only when Service Interrupted is set to Yes.

    Enter the time when the fault occurs.

    Fault Rectification Time

    This parameter is required only when Service Interrupted is set to Yes.

    Enter the time when the fault is rectified.

    Description

    (Optional) Enter remarks.

    The remarks can contain at most 100 characters, including letters, digits, and special characters.

    The time from fault occurrence until service recovery is called the service interruption time. The service interruption time consumed for alarm clearance can be automatically recorded in the SLO interruption records of the corresponding application. The procedure is as follows:

    1. Create a custom SLA and set Trigger Type to Alarm. Select the severity and applications of aggregated alarms.
    2. Create an SLO and select the applications of aggregated alarms.
    3. After an aggregated alarm is generated, if the severity and applications match the SLA record settings, an SLA record is created.
    4. Clear the aggregated alarm and specify the fault occurrence time and service recovery time. An SLO interruption record is generated. You can view the interruption records in the Operation column of the corresponding SLO.

  6. Click OK.

Viewing Historical Alarms

The historical alarms page displays cleared aggregated alarms. After an aggregated alarm is cleared, you can view its information and handling records on the Historical Alarms page.

The system retains alarm data for 31 days. After this period, the data will be automatically deleted.

  1. Log in to COC.
  2. In the navigation pane, choose Fault Management > Alarms.
  3. Choose Aggregated Alarms > Historical Alarms to view the historical aggregated alarms.
  4. Locate the alarm to be viewed and choose More > History Records in the Operation column to view the historical records.

Helpful Links

On COC, APIs can be called to handle alarms, convert alarms to incidents, clear alarms in batches, and query alarm details. For details, see Alarm Management.