3. Escalation of Messaging in Zenoss

You can create a messaging hierarchy using some of the different managing tools available in Zenoss.

3.1. Creating an Alerting Hierarchy

You can create a alert Hierarchy based on event status and delays using Alerting Rules. For example, you send an alert to Person A (for example the first level, on call tech) as soon as any event of a given priority occurs, if that event is not Acknowledged or Suppressed (changing the status of the event) within a given time frame (For example, an hour) you create an additional alerting rule to send email to the next person in the Alert Hierarchy, for example Person B.

To create this hierarchy, first, you create an Alerting Rule for the Default case (the initial state). This case is "Any when any new event of whatever priority occurs, alert Person A. To create this default rule, just create the Alerting rule as usual. Set the Delay at 0 (Zero) seconds. Now for the next level in the alerting hierarchy (Person B) you want to say "OK, if Person A does not acknowledge or suppress the event within an hour - then send an Alert to the next person in the hierarchy (Person B). To create this hierarchy in Zenoss, you have to create an additional alerting rule for Person B. There are 2 ways of doing this - you can A) Create an additional rule for the User account you are currently logged in as or B) You can just add the additional (Person B's email address in the Address (optional field). This added address overrides the User account email so email will only be sent to the newly added email address.

For the 2nd Alerting Rule, set the delay to the number of seconds you want to wait after an event has come in and has not been acknowledged or cleared. For our example, we have determined that time-frame to be one hour. One hour is 3600 seconds. So in the Delay box for the Alerting Rule, enter 3600.

Now we need to pass a condition that will keep this alert from firing on all events, even the ones that Person A acknowledges or Suppresses before the hour expires. In the Add filter area, select Event State and then select the event state that will keep this rule from being executed on ALL events, even ones acknowledged by Person A. In this case, an Event is considered to have a state of New unless it has been either Suppressed or Acknowledged so let’s leave the setting at New. So now this alerting rule will send email to Person 2's email if an event remains in the New State for more than 3600 seconds (one hour)

So this section defines a small 2 person hierarchy, but you can use the filters for alerting rules to create much more sophisticated alerting hierarchies and scenarios. Device priority is a new attribute that will work great for defining which person gets which alerts unless a device has a certain priority level in which case everyone gets the alert.