Threshold based monitoring using agent

Tapish Sharma1
Kilo Sage

‎09-02-2023 02:02 PM

Hi Folks, 

I have installed agents in windows systems, and need to monitor basic metrics like CPU utilization , available space etc. I want to generate events and alerts based on threshold values , for eg if CPU utilization is greater than 90% raise critical alert.

As soon as I set up agents , I can see some events getting generated OOB with following description and metric 

description -  CPU Load CRITICAL: The total CPU utilization is 100.00% . Warning Threshold: 85. Critical Threshold: 95

metric - os.windows.metrics-system-cpu-load

 

I cannot find anywhere to modify these threshold values ....Any inputs would be helpful 

 

 

 

0 Helpfuls
  • 1,545 Views
1 REPLY 1

Prabu Velayutha
Mega Sage

‎09-02-2023 03:40 PM

@Tapish Sharma1 You can Set a threshold to suppress alert generation. Please follow the procedures in the document. Revert if you have any questions.

 

 https://docs.servicenow.com/en-US/bundle/vancouver-it-operations-management/page/product/event-manag...

 

 

You can configure the properties in an event rule to create alerts, suppress alert generation, or close existing alerts according to a specified threshold. The threshold is based on the value of event fields or number of occurrences over a specified period.

Note: Field Name can be the name of any numeric field in the Additional information field of the event. Therefore, if CPU is an additional information field for a specific event, then CPU can be used as a Field Name.
Assume that you want to generate an alert when CPU utilization reaches or exceeds 80% three times with no more than 20 seconds between any two consecutive events. Create an event rule with these settings (an explanation for each value is given in parentheses):
  • Create Alert Operator: >= (operator to determine whether utilization of Field Name reaches or exceeds the specified value)
    • Field Name: CPU (events regarding high CPU usage)
    • Threshold Value: 80 (percent)
    • Occurs: 3 (three events occur where the CPU usage is at or above ">=" 80%)
    • Over(seconds): 20 (20 seconds or less between events)
    To demonstrate how the preceding settings are evaluated, assume that the following events are received

 

Procedure

  1. Navigate to All > Event Management > Rules > Event Rules.
  2. Create or open an event rule.
  3. Click Threshold.
  4. Select Active.
    If Active is not selected, the fields on this page do not appear.
  5. In the Create Alert Operator field, select an operator.
    • If you select Count, specify the corresponding Occurs and Over(seconds) fields.
    • If you select any operator other than Count, the Field name and Threshold value fields appear. Specify the required values in these fields

    If my response helps to solve your issue. Kindly mark it as helpful & correct.

0 Helpfuls