15.8. Defining Drift Alerts

Click the Inventory tab in the top menu.

Select the resource type in the Resources menu table on the left, and then browse or search for the resource.

Click the resource name in the list.

Click the Alerts tab for the resource.

In the Definitions subtab, click the New button to create the new alert.

In the General Properties tab, give the basic information about the alert.

It may be useful to set a Priority if the drift definition contains critical configuration files.

In the Conditions tab, select the Drift Detection option from the conditions list. To use the alert for all drift changes, leave the fields blank. Otherwise, enter the specific drift definition name and (optionally) the directories or files that must be modified for the alert to be triggered.

In the Notifications tab, click Add to set a notification for the alert.

Select the method to use to send the alert notification in the Sender option, and fill in the required information.

The Sender option first sets the specific type of alert method (such as email or SNMP) and then opens the appropriate form to fill in the details for that specific method.

Optionally, in the Dampening tab, give the dampening (or frequency) rule on how often to send notifications for drift.

Any of the dampening rules can be used. The ultimate goal is to limit the number of times that the same alert is set for a resource that is out of compliance with a pinned definition. For example, Time period sets a limit on the number of times in a given time period that an alert is issued if the alert condition occurs. Setting the occurrence to 1 and the time period to 4 hours means that when drift is detected once, the server sends an alert and then waits another 4 hours before sending the next alert.

Click OK to save the alert definition.