Alerts and incidents

An alert rule is something Witina checks for. When a rule finds a problem, it opens an incident: the record you acknowledge, work on, and resolve. Rules are under Monitoring → Alerts, and incidents under Monitoring → Incidents.

Alert rules

Witina comes with built-in rules, marked Default. You can turn them off, but not delete them. They cover:

• Reachability and credentials: devices Witina can’t reach or log in to, missing credentials, and devices that aren’t being polled.
• Gateways and controllers: a gateway offline or failing to update, a controller that can’t sync, and gateway CPU and memory.
• Layer 2: spanning-tree problems (more than one root, a root that changed, storms of topology changes), spanning-tree hardening, VLAN naming, and duplicate MAC addresses.
• Ports: link speed mismatches, ports that went down, an unexpected device on a locked-down port, and unexpected numbers of MAC addresses.
• Rogue routers and DHCP servers, and firmware drift.
• Metrics: utilization, errors, CPU, reboots, and devices that stopped sending SNMP data.

To add your own, choose New alert rule on the Alerts page.

Incidents

Each incident has a severity: Info, Low, Medium, High, or Critical. It moves through these states:

1. Created: the rule found a problem.
2. Acknowledged: someone is on it.
3. Resolved: the problem is gone.

A resolved incident can then be archived by hand.

Some incidents come with a suggested fix. Remediate turns it into a change you can review and apply.

How incidents close by themselves

• Problems found by checking a device close when a later check shows the problem is gone. They don’t close because time passed or because data stopped arriving.
• Metric problems close when the measurement is back within the rule’s limits, or when the device no longer falls under the rule.
• Deleting a device closes its incidents. Deleting or pausing a rule lets you choose whether to resolve its incidents.

A resolved incident doesn’t reopen. If the problem comes back, Witina opens a new incident.

Rolled up

When a device is unreachable or its gateway is offline, other problems follow from it: Witina can’t connect, collection fails, data stops arriving. Witina files those incidents under the one that caused them. They’re rolled up: they stay open, but they don’t notify anyone on their own, and they’re hidden from the incident list unless you tick Show rolled-up. A rolled-up incident isn’t resolved; it’s waiting on its cause.

Silencing alerts

To silence	Where
One rule	Open the rule, then Overrides → Add override. Choose Silence or Disable, for an hour, up to 7 days, or Indefinite, with a reason.
A device or a region	Silence alerts on the device’s or region’s page
One incident, for everyone	Suppress for everyone on the incident: just this incident, or the whole finding
One incident, for you	Mute for me on the incident
Everything, on a schedule	Organization Admin → Maintenance windows: one-time, daily, or weekly

Silencing stops new incidents and notifications. Incidents that are already open stay open.

For how incidents affect a customer’s health, see The customers dashboard.