Overview
What is EMS (Event Management System) ¶
EMS (Event Management System) is a powerful platform designed to capture, visualize, and manage events triggered by meeting specific threshold conditions. It serves as a centralized hub for monitoring and analyzing various types of events, enabling organizations to efficiently detect and address different levels of failures in their systems. With EMS, you can gain valuable insights into the health and performance of your infrastructure, allowing for proactive decision-making and effective incident response.
Event Types ¶
- SNMP Event: SNMP (Simple Network Management Protocol) events are captured by EMS from network devices and systems that support SNMP. These events provide valuable information about network performance, device status, and potential issues. By collecting and analyzing SNMP events, EMS empowers organizations to monitor their network infrastructure in real-time and identify potential problems before they escalate.
- API Event: API events in EMS are triggered by interactions with application programming interfaces. These events capture important data related to API calls, such as response times, error codes, and request volumes. Monitoring API events enables organizations to ensure the stability and reliability of their integrations, identify performance bottlenecks, and detect potential API-related issues.
- Email Event: EMS captures and analyzes email events, which involve monitoring the flow of emails within an organization's email infrastructure. These events can provide insights into email delivery status, latency, and potential issues with email servers or configurations. By monitoring email events, organizations can proactively address email-related problems and ensure smooth communication channels.
By supporting a diverse range of event types, EMS enables organizations to have a comprehensive view of their systems, identify anomalies, and take proactive measures to maintain the stability and reliability of their infrastructure.
Event Level ¶
EMS (Event Management System) categorizes events into different levels to indicate their severity and importance. Each level helps prioritize and focus on the events that require immediate attention. The following are the defined event levels in EMS:
-
OK: The OK level indicates that the system or component is functioning normally without any issues or anomalies. It signifies a healthy state of operation.
-
Info: The Info level represents informative events that provide useful insights or notifications about system activities, status updates, or changes. These events are typically used for informational purposes and do not require immediate action.
-
Warning: The Warning level signifies events that indicate potential issues or anomalies that could impact system performance or functionality. While not critical, warnings serve as early indicators of problems that may require attention in the future.
-
Minor: The Minor level indicates events that represent minor issues or deviations from normal operation. Although not critical, these events should be addressed to prevent them from escalating into more severe problems.
-
Major: The Major level represents events that indicate significant issues or disruptions to system functionality. These events require attention and action from administrators or operators to restore normal operation and minimize the impact on the system.
-
Critical: The Critical level signifies events that represent severe and urgent problems that require immediate attention. These events indicate a critical failure or disruption in the system that needs to be addressed promptly to restore normal operation and prevent further damage.
External Severity Mapping to EMS(Case Insensitive) ¶
| External Severity | EMS Severity | EMS Severity Code |
|---|---|---|
| critical | Critical | 5 |
| major | Major | 4 |
| minor | Minor | 3 |
| warning | Warning | 2 |
| info | Info | 1 |
| ok | OK | 0 |
| External Severity | EMS Severity | EMS Severity Code |
|---|---|---|
| P1 | Critical | 5 |
| P2 | Major | 4 |
| P3 | Minor | 3 |
| P4 | Warning | 2 |
| P5 | Info | 1 |
| P6 | OK | 0 |
| External Severity | EMS Severity | EMS Severity Code |
|---|---|---|
| high | Critical | 5 |
| low | Warning | 2 |
| External Severity | EMS Severity | EMS Severity Code |
|---|---|---|
| 1 | Critical | 5 |
| 2 | Major | 4 |
| 3 | Minor | 3 |
| 4 | Warning | 2 |
| 5 | Info | 1 |
| 0 | OK | 0 |
| External Severity | EMS Severity | EMS Severity Code |
|---|---|---|
| error | Critical | 5 |
| warning | Warning | 2 |
| info | Info | 1 |
| ok | OK | 0 |
These mappings are valid together and source-independent, so you can mix them as needed. See the Grafana Alert Sample to know how does it work
Event Status / Life cycle ¶
-
Open: New event come into EMS, the event will be in Open status.
-
Acked: Once the event been take care of by someone manually do acknowledge action or matched some auto escalation rule triggered notification, the event will be in Acked status.
-
Closed: When the event been move to close queue manually or the event related SNOW ticket been closed, the event will be set in Closed status.