Home > Storage > PowerScale (Isilon) > Product Documentation > Management and Migration > PowerScale OneFS: Advanced Alert Configurations > Alert architecture
Figure 1 shows the overall architecture of the alert system in OneFS.
Event Capture is the first stage in the processing pipeline. It is responsible for reading event occurrences from the kernel queue, storing them safely on persistent local storage, generating attachments and queueing them in priority buckets for analysis.
Event Analysis is the second stage in the processing pipeline. The main analysis process collects related event occurrences together as event group occurrences, which can be processed by the next stage – Reporter.
Reporter is the third stage in the processing pipeline. The reporter periodically queries Event Analysis for event group occurrences which have changed. For each of these changes, Reporter evaluates any relevant alert conditions, generating alert requests for any events which are satisfied to the next stage – Alerter.
Alert Condition defines how event group occurrences are alerted. An alert condition states that a specified set of event groups will be reported on by a specified set of channels under a specified condition as described in Table 1:
Description | |
New event groups | Reports on event group occurrences that have never been reported on before. |
New events | Reports on event group occurrences that are new since the event group was last reported on. |
Interval | Provides periodic reports on event group occurrences that have not been resolved. |
Severity increase | Reports on event group occurrences whose severity has increased since the event group was last reported on. |
Severity decrease | Reports on event group occurrences whose severity has decreased since the event group was last reported on. |
Resolved event group | Reports on event group occurrences that have been resolved since the event group was last reported on. |
Alerter is the final stage in the processing pipeline. It is responsible for actually delivering the alerts requested by the reporter.
Channel is a named destination for alerts. A channel specifies the mechanisms by which alerts are sent, which are listed below:
Figure 2 shows the relationship between event group categories, event types, and event groups.
Event group category defines 10 subsets of events at a very high level as listed in Table 2. For each event group category, there are several events defined. An event definition is also known as an event type which is for a specific type of event. Event groups contain closely related event occurrences.
Event group category name | |
100000000 | System disk events |
200000000 | Node status events |
300000000 | Reboot events |
400000000 | Software events |
500000000 | Smart Quotas events |
600000000 | Snapshot events |
700000000 | Windows Networking events |
800000000 | Filesystem events |
900000000 | Hardware events |
1100000000 | CloudPool events |
Event groups are collections of individual events that shares related symptoms of a single situation on the PowerScale cluster. Event groups provide a single point of management for multiple event instances that are generated in response to a specific situation on the cluster. Starting from OneFS 8.0, the related events are organized into event groups. In this case, the CLI command isi event is an abbreviation for isi event group.