5.8. Defining Drift Alerts

PDF

Drift changes have their own alert condition.

Note

Recovery alerts are not supported for drift.

Click the Inventory tab in the top menu.
Select the resource type in the Resources menu table on the left, and then browse or search for the resource.
Click the resource name in the list.
Click the Alerts tab for the resource.
In the Definitions subtab, click the New button to create the new alert.
In the General Properties tab, give the basic information about the alert.
It may be useful to set a Priority if the drift definition contains critical configuration files.
In the Conditions tab, select the Drift Detection option from the conditions list. To use the alert for all drift changes, leave the fields blank. Otherwise, enter the specific drift definition name and (optionally) the directories or files that must be modified for the alert to be triggered.
Note
There can be more than one condition set to trigger an alert, meaning that you can use the same alert for multiple drift definitions or files.
In the Notifications tab, click Add to set a notification for the alert.
Select the method to use to send the alert notification in the Sender option, and fill in the required information.
The Sender option first sets the specific type of alert method (such as email or SNMP) and then opens the appropriate form to fill in the details for that specific method.
Optionally, in the Dampening tab, give the dampening (or frequency) rule on how often to send notifications for drift.
Note
For pinned snapshots, it can be useful to use dampening rules to keep from getting a flood of alerts before a drift problem is remedied.
Dampening only makes sense for a definition with a pinned snapshot. A pinned definition will fire alerts with every alert scan (every 10 minutes) for as long as it is out of compliance, even if there are no further changes. A rolling definition only fires an alert once, when drift is detected.
Any of the dampening rules can be used. The ultimate goal is to limit the number of times that the same alert is set for a resource that is out of compliance with a pinned definition. For example, Time period sets a limit on the number of times in a given time period that an alert is issued if the alert condition occurs. Setting the occurrence to 1 and the time period to 4 hours means that when drift is detected once, the server sends an alert and then waits another 4 hours before sending the next alert.
Click OK to save the alert definition.