Creating an Alarm Conversion Rule

What Is an Alarm Conversion Rule?

Alarm conversion rules process all ingested raw integrated alarms by performing suppression, noise reduction, deduplication, and routing. They support vertical suppression and horizontal convergence across multiple monitoring sources to achieve multi-dimensional noise reduction.

These rules can aggregate one or more disparate raw alarms into a single aggregated alarm. Conversely, a single raw alarm can also trigger multiple conversion rules simultaneously. For details about the configuration items of alarm conversion rules, see Table 2.

Prerequisites

• Before configuring an alarm conversion rule, ensure that the monitoring system for which the alarm conversion rule you want to configure has been connected in the Data Sources module.

Constraints

• Once an alarm conversion rule generates an incident, no new incidents will be created by that same rule if its conditions are met again, provided the existing incident has not yet reached the Completed or Closed status. This suppression mechanism is enabled by default but can be disabled.
• If you receive no raw alarms within the corresponding time window for generating aggregated alarms using alarm conversion rules, the system considers the alarms generated in the previous window period as historical alarms (that is, the current alarm status is set to Handled by default).

Creating an Alarm Conversion Rule

1. Log in to COC.
2. In the navigation pane, choose Fault Management > Alarm Forwarding Rules.
3. On the page that is displayed, click Create in the upper right corner. The page for creating an alarm conversion rule is displayed.
4. On the page, set basic information about the alarm conversion rule by referring to Table 1.

   Table 1 Basic information parameters

   Parameter	Description
   Rule	Specify the name of the alarm conversion rule you want to create.
   Region	(Optional) Select a region. If no region is selected, default is displayed, indicating that no region is required.
   Enterprise Project	Select an enterprise project.
   Application	Select an application.

5. On the page, set trigger conditions for the alarm conversion rule by referring to Table 2.

   Table 2 Parameters for configuring a trigger rule

   Parameter	Description
   Trigger Type	The options are Incident and Alarm. Incident: An incident ticket is generated. The on-duty personnel need to handle the incident ticket as soon as possible and continuously trace the incident ticket until it is closed. Alarm: Alarms are generated and are manually or automatically closed based on response plans.
   Data Source	Select a data source. A data source is the system where raw alarms are from. Before configuring a trigger rule, ensure that data source has been integrated and enabled. When all conditions are met, the alarm conversion rule is triggered. For details about how to set the data source, see Integrating a Monitoring System.
   Trigger Conditions	Select the key, comparison method, and value for the trigger conditions. A maximum of five trigger conditions can be added. For details about how to set the keys, see Table 3.
   Trigger Rule	Select a trigger rule.
   Incident Level	This parameter is required only when Trigger Type is set to Incident. The options are P1, P2, P3, P4, and P5. P1 incidents are the most critical, while P5 incidents are the least severe.
   Silence Rule	This parameter is required only when Trigger Type is set to Incident. Enable or disable this rule as required. After an incident is generated based on the alarm conversion rule, a new incident ticket will not be generated if the trigger rule is met before the incident ticket is completed or closed.
   Alarm Severity	This parameter is required only when Trigger Type is set to Alarm. The value can be Critical, Major, Minor, or Warning.

   Table 3 Parameters for trigger conditions

   Parameter	Description	Alarm Field from Cloud Eye	Alarm Field from AOM
   alarmId	Alarm ID	alarm_id	id
   alarmName	Alarm name	alarm_name	event_name in the metadata
   alarmLevel	Alarm severity. The options are Critical, Major, Minor, and Warning.	AlarmLevel	event_severity
   time	Time when an alarm is generated	time	starts_at
   nameSpace	Service namespace	namespace	namespace
   region	Region	Region in template_variable	/
   application	Application name	/	/
   resourceName	Resource name	ResourceName in template_variable	resource_id in the metadata
   resourceId	Resource ID	ResourceId in template_variable	/
   alarmDesc	Alarm description	AlarmDesc in template_variable	/
   URL	Raw alarm URL	Link in template_variable	/
   alarmStatus	Alarm status. The value can be alarm (active alarm) or ok (alarm handled).	alarm_status	/
   alarmSource	Alarm data source. For example, if an alarm is reported from Cloud Eye, the value is Cloud Eye.	/	/
   additional	Additional alarm information. Format: additional.xxx.	Except the preceding parameters, other parameters are contained in this parameter and are represented by additional.xxx. For more information about parameters on Cloud Eye, click here.	Except the preceding parameters, other parameters are contained in this parameter and are represented by additional.xxx. For more information about parameters on AOM, click here.
   recTime	Time when COC receives an alarm. The value is a 13-digit timestamp.	/	/

6. Set the response plan to be executed after the alarm conversion rule is triggered. For details, see Table 4.

   Table 4 Response plan parameters

   Parameter	Description
   Task Type	The options are Contingency plan, Script, and Job.
   Automatic Execution	Determine whether to automatically execute what you have selected. Automatic contingency plans, scripts, and jobs can be automatically executed. If you select Automatic Execution, Parameter Mapping will be displayed. The system automatically executes tasks based on the trigger conditions and settings. The parameter value, region ID, and target instance must be in the format of ${}. You need to use this expression to parse the corresponding value. For details, see Examples of Automatic Execution Parameters. If you deselect Automatic Execution, you can click the link on the left to manually execute the task.

7. Set the owner to whom the alarm or incident is assigned after the conversion.

   Table 5 Parameters for configuring a dispatch rule

   Parameter	Description
   Owner	Select Shift or Individual. Shift: Select a shift scenario and corresponding roles from the drop-down lists based on the configured values. For details about how to configure a shift, see Shift Schedule Management. Individual: Select an owner. For details about how to configure an owner, see Personnel Management.

8. Click OK.

   After the rule is created, you can view the created rule in the alarm conversion rule list. After rules are configured for integrated data sources, any reported raw alarm will be automatically converted to an aggregated alarm or an incident that can be automatically handled.

Examples of Automatic Execution Parameters

The parameter value, region ID, and target instance must be in the format of ${}. You need to use this expression to parse the corresponding value.

Example:

Alarm data:

{
"alarmId": "al1696664837170EWbvx24kW",
"alarmName": "alarm-4z39coctest1007",
......
"URL": "https://console.***.com/ces/?region=***#/alarms/detail?alarmId=al16849986549022X5Vp4pxr",
"additional": {
"dimension": "instance_id:29d99a09-2d15-4ced-8723-6e94ae1c1472",
......
},
......
}

• To obtain the value of alarmId in the current alarm data, use the following expression:

  ${currentAlarm.alarmId}

• To obtain the UUID of instance_id from the additional.dimension string, use the following expression:

  ${string.substring(currentAlarm.additional.dimension, string.indexOf(currentAlarm.additional.dimension, 'instance_id:') + 12)}

  Alternatively, use the following expression:

  ${string.substring(currentAlarm.additional.dimension, 12)}

• To obtain the region ID of cn-north-7 from the URL string, use the following expression:

  ${string.substring(currentAlarm.URL, string.indexOf(currentAlarm.URL, 'region=') + 7, string.indexOf(currentAlarm.URL, '#/alarms'))}

  In the expression, currentAlarm. is a fixed prefix, which indicates that the data is obtained from the existing alarm data.

More Operations

After an alarm conversion rule is created, you can disable, enable, modify, copy, or delete the rule.