Alerts and Notifications
Generate Alert Notifications
Paragon Insights (formerly HealthBot) generates alerts that indicate when specific KPI events occur on your devices. To receive Paragon Insights notifications for these KPI events, you must first configure a notification profile. Once configured, you can enable alert notifications for specific device groups and network groups.
Paragon Insights supports the following notification delivery methods:
Web Hook
Slack
Kafka Publish
Microsoft Teams (HealthBot Release 2.1.0 and later)
Email (HealthBot Release 2.1.0 and later)
Advanced Message Queuing Protocol (AMQP) Publish (Paragon Insights Release 4.0.0 and later)
This section includes the following procedures:
Configure a Notification Profile
A notification profile defines the delivery method to use for sending notifications.
NOTIFICATION TYPE DETAILS
Web Hook
URL URL at which the Web Hook notification should be posted.
Username (Optional) Username for basic HTTP authentication.
Password (Optional) Password for basic HTTP authentication.
Slack
URL URL at which the Slack notification should be posted. Different from your Slack workspace URL. Go to https://slack.com/services/new/incoming-webhook and sign in to your Slack workspace to create a Slack API endpoint URL.
Channel Channel on which the notification should be posted.
Kafka Publish
Bootstrap Servers Add Kafka host:port pairs from the drop-down list to establish the initial connection to the Kafka cluster.
Topic (Optional) Name of the Kafka topic to which data will be published. By default, the Kafka topic naming convention for device group alert notifications is device-group.device-id.topic.rule.trigger.
Depending on the authentication protocols being used, the required authentication parameters are as follows:
Protocol |
Required Parameters |
---|---|
SASL/SSL |
Username, password and certificate |
SASL/Plaintext |
Username and password |
SSL |
Certificate |
Plaintext |
None |
Username Username for SASL/SSL or SASL/plaintext authentication.
Password Password for SASL/SSL or SASL/plaintext authentication.
Certificate Kafka server’s CA certificate. Choose file from the drop-down list.
Upload Certificate Location from where the Kafka server’s CA certificate will be uploaded. Click Choose files and navigate to the file location. File should be in Privacy Enhanced Mail (PEM) format.
Microsoft Teams
As of HealthBot Release 2.1.0, you can send Paragon Insights (formerly HealthBot) notifications to Microsoft Teams. Teams can provide a connector which you can add to Paragon Insights to enable the connection.
Configuration workflow:
In Teams, create a new connector set as an incoming webhook.
Copy the URL provided by Teams.
In Paragon Insights, configure a notification profile that sends to Microsoft Teams.
Apply the notification profile to a device group.
To configure MS Teams notifications:
In Teams, select the desired channel and click the ellipsis (...).
In the menu that appears, click Connectors.
Use the Incoming Webhook option and click Configure.
On the next page, click Create.
Once the web hook is successfully created, copy the provided URL.
In Paragon Insights, go to the Settings > System page select the Notification tab.
Click the + Notification button.
Configure the notification profile as follows:
Name - Enter a profile name.
Notification Type - select Microsoft Teams.
Channel - Paste the URL provided by the Teams UI above.
Click Save and Deploy.
Apply the notification profile to a device group or network group as shown in Enable Alert Notifications for a Device Group or Network Group
EMails
As of HealthBot Release 2.1.0, you can send Paragon Insights (formerly HealthBot) notifications by email. By default, email notifications cover all running playbooks and rules for the device group or network group to which they are applied, however you can narrow the focus by selecting specific rules.
Paragon Insights includes its own mail transfer agent (MTA), so no other mail server is required.
Configuration workflow:
In Paragon Insights, configure a notification profile that sends to email.
Apply the notification profile to a device group.
To configure email notifications:
In Paragon Insights, go to the Settings > System page.
Select the Notification tab and click the the + Notification button.
Configure the notification profile as follows:
Name - Enter a profile name.
Notification Type - Select Emails.
Email Addresses - Enter an email address and click Add <email-address>; repeat for more email addresses.
(Optional) Rule filters - To narrow the scope of what triggers an email, define rule filters. Enter a filter and click Add <rule-filters>; repeat for more filters.
Format is topic/rule; can use regular expressions
Example: interface.statistics/check-interface-flaps sends notifications only for the rule check-interface-flaps.
Example: system.processes/.* , system.cpu/.* , and interface.statistics/.* sends notifications for all rules under the topics system.processes, system.cpu, and interface.statistics.
Click Save and Deploy.
Apply the notification profile to a device group or network group as shown in Enable Alert Notifications for a Device Group or Network Group
AMQP Publish
If you select AMQP Publish as the notification type, you have to specify the following:
Host (mandatory)—Specify a valid hostname or the IP address of the AMQP server.
Port (mandatory)—Specify the listener port of the AMQP server.
Exchange(mandatory)—Specify the name of the exchange or the routing agent of the AMQP server on which the connection must be instantiated.
Virtual Host(optional)—Specify the virtual host of the AMQP server on which the connection must be instantiated. If you do not specify, the default value(/) is used.
Routing Key(optional)—Specify the routing key. The routing key is a message attribute that the exchange refers to when deciding how to route the message to the queue.
Note:If you have not configured the routing key, the following are the default value:
For sensor or raw data, <device-group>.<device>.sensors
For field data, <device/network-group>.<device>.<topic>.<rule>.fields
For trigger/alert data, <device/network-group>.<device>.<topic>.<rule>.<trigger>
In case of a network group, <device> is rendered as “-”.
Username—Specify the username for the Simple Authentication Security Layer (SASL) authentication.
Password—Specify the password for the SASL authentication.
CA Profile—Select the CA profile from the drop-down list. For more information on CA Profiles and local certificates, see Configure a Secure Data Connection for Paragon Insights Devices.
Local Certificate—Select the local certificate from the drop-down list. For more information on CA Profiles and local certificates, see Configure a Secure Data Connection for Paragon Insights Devices
Server Common Name—Specify the server common name that is used while creating a certificate.
Enable Alert Notifications for a Device Group or Network Group
To enable alert notifications for a device group or network group:
Manage Alerts Using Alert Manager
You can use the Alert Manager feature to organize, track, and manage KPI event alert notifications received from Paragon Insights devices. The Alert Manager does not track alerts by default; it is populated based on which device groups or network groups are configured to send the notifications.
Viewing Alerts
To view the alerts report table, go to the Monitor > Alerts page in the left-nav bar. Note that Alert Manager consolidates duplicate alerts into one table entry and provides a count of the number of duplicate alerts it has received.
Starting with release 4.2.0, Paragon Insights generates smart alerts if you configured resources and dependencies. To configure resources, click Resource Discovery at the top right corner of the Alerts page.
Smart alerts combine alerts from different rules into a collapsible tree structure. The main alert in the tree displays the root cause that triggered the other alerts in the tree. See Understand Resources and Dependencies for more information.
The following table describes the alerts report table attributes.
Attributes |
Description |
---|---|
Severity |
Severity level of the alert. Options include:
|
Status |
Management status of the alert entry. Options are Open, Active, Shelved, Closed, and Ack. The statuses available in the Status pull-down menu in the top row of the table only include statuses of alerts visible in the table and those allowed by the status filter above the table. |
Last Received |
Time the alert was last received. |
Dupl. |
Duplicate count. Number of times an alert with the same event, resource, environment, and severity has been triggered. |
Topic |
Device component topic name. |
Resource |
Device name. |
Event |
Name of the rule, trigger or field, and event with which the alert is associated. |
Text |
Health status message. |
The following table describes the main features of the alerts report table:
Feature |
Description |
---|---|
Sort the data by ascending or descending order based on a specific attribute. |
Click on the name of the data type at the top of the column by which you want to sort. |
Filter the data based on the device group. |
In the drop-down list at the top left corner of the page, select a device group by which to filter. |
Filter the data based on the alert status. |
Two options:
|
Filter the data based on the severity, topic, or resource |
In the associated drop-down list for each attribute at the top of the table, select an option by which to filter. |
Filter the data based on a keyword. |
In the associated text box under the Event or Text attribute name at the top of the table, enter the keyword on which to filter. |
Filter the data based on date or time received. |
In the Last Received field, enter a date and time in the format: <Day> <DD> <Mon> <HH:MM> |
Navigate to a different page of the table. |
Two options:
|
Change the number of rows displayed. |
At the bottom of the table, choose the number of rows to display in the drop-down list. The table displays 20 rows by default. |
If the data in a cell is truncated, view all of the data in a cell. |
Resize the column width of the cell by dragging the right side of the title cell of the column to the right. |
Manage Individual Alerts
You can view detailed information about each alert in the alerts report table. You can also assign a management status (such as open, ack, and close), and apply simple actions (such as shelve and delete) to each alert.
To manage individual alerts:
Go to the Monitor > Alerts page from the left-nav bar to open the alert report table.
Click on a single alert entry in the table. The Alert Details pane displays detailed information about the alert.
The following table describes the set of buttons at the top of the Alert Details pane:
Button |
Description |
---|---|
Open |
Changes the status of the alert to Open. |
Shelve |
Removes the alert from the table for a set amount of time. Time options are 1, 2, 4 and 8 hours. Click Unshelve to disable this feature. |
Ack |
Changes the status of the alert to Ack. The Ack status removes the alert from the table, but the alert still remains active. |
Close |
Changes the status of the alert to Closed. The Closed status indicates that the severity level of the alert is now Normal. |
Delete |
Deletes the alert from the table. |
Configure Alert Blackouts
You can configure blackout periods to suppress or mute alerts during, for example, scheduled downtimes.
To configure blackouts:
Click the Settings > System page from the left-nav bar.
Select the Alert tab on the left side of the page.
In Alert Blackout Settings, click the + Alert Blackout button.
Enter the necessary values in the text boxes for the blackout configuration.
The following table describes the attributes in the Add an Alert Blackout pane:
Attributes
Description
Duration
Select a start and end date and time for the blackout.
Device Group
Select a device group from the drop-down list to which to apply the blackout configuration.
Attribute
(Optional) Specify an attribute from the drop-down list to which to apply the blackout configuration.
Value
(Optional) If a blackout attribute is specified, provide an associated value (as shown in the alerts report table). Only the alerts that match this attribute value exactly will be suppressed from the alerts report table.
Note:For the Resource-Event attribute, you must specify a resource from the drop-down list, as well as specify an Event value. Only the alerts generated by the specified resource that match this Event value exactly will be suppressed from the alerts report table.
Click Save to save the configuration.
(Optional) Click the Delete button to delete a blackout configuration.
Stream Sensor and Field Data from Paragon Insights
You can configure Paragon Insights to publish Paragon Insights sensor and field data for a specific device group or network group. You must first configure the notification type for publishing and then specify the fields and sensors that you want published.
Configure the Notification Type for Publishing
Paragon Insights supports Apache Kafka and AMQP for publishing sensor and field data.
You must first configure a Kafka publishing profile before you can start publishing sensor and field data for a specific device group or network group.
To configure a Kafka publishing profile:
Publish Data for a Device Group or Network Group
To publish Paragon Insights sensor or field data for a device group or network group:
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.