One or more conditions can be added to each Threshold, with each condition being defined by a Where Clause. The Where Clause is used to monitor for specified criteria on fields from the selected Record. For example:
A Threshold can be set to detect when any CPU is greater than 75% busy for more than 2 minutes and then issue an event to inform operators of this fact.
Events can be fed to automation software or to the Automated Analyst in order to process exception data through a set of automation rules to effortlessly recover from a system problem.
Thresholds request the records they are defined against and when a record arrives that matches the Where Clause, the Threshold is 'triggered' for that record. This generates an 'ON' event.
If the Threshold condition has a message destination with an 'OFF' event, the record is 'remembered' so that the Threshold will not trigger again for the same record in the following intervals. When the record is no longer present, the Threshold is no longer 'triggered' and the 'OFF' event occurs. If the record appears again, the Threshold is triggered again and a new alert is logged.
If an acknowledgment is required, the record is 'remembered' until it is acknowledged. Once the operator has acknowledged the event, the Threshold forgets the record (unless there is 'OFF' event processing as above). If the record appears again, the Threshold is triggered again and a new alert is logged.
If the Threshold has a log frequency set up, the record is 'remembered' for that many intervals so that it will not generate a new message until that time has passed.
If none of the above are present then the record is immediately forgotten. This means that if it occurs again in the next interval, another alert will be generated.
If required, individual conditions in a Threshold can be set to be disabled when the Threshold is started and then started manually by an operator when a situation requires monitoring. For details see Starting/Stopping a Threshold Condition.