Hi Dojo,
I’m trying to create a correlation rule that sends an email when an element (it’s the Microsoft server where is hosted the DMA) is in Not reachable state, for example this agent is restarting or went off for any reason:
Is this state related to some of the defined in the Severity dropdown?
It is there any definition that can help me with this?
Thanks in advance!
Hi David,
If you want to send emails when an element is not reachable, you can monitor its severity – a timeout state (severity 7) can be used in a correlation rule to send an email.
The state in your screenshot is not a severity to have a number associated – this means the element is disconnected, i.e., the DMA hosting the element is not reachable or down.
If one element is in this state, all elements in that DMA will also be in this disconnected state.
In such a case, as Miguel mentioned, you can use an information event to track if the DMA goes down (say heartbeat) and use the information event in correlation to send an email.
Hi David,
If one element in a DMA is in 'Not reachable' state, all elements hosted in that DMA will not reachable as well. Is it not an option to use an information event to trigger the email notification?