escalation.pod

Network Management Information System

=head1 NAME

Escalation Policy

=head1 DESCRIPTION

You can add, edit and delete entries to the NMIS Escalation Policy table.
This controls when current events in the L<Current Events Table|menu.pod/Current Events> are escalated by NMIS.
Only un-acknowledged events are escalated here.
Events are matched to Escalation Policy through keyword matching on Group, Role, Type, Event fields. Further granularity is possible by regex matching on Event_Node and Event_Details fields.

The first 4 fields are the table key, and taken together, must represent a unique string. These are used to match on a particular event in the L<Current Events|menu.pod/Current Events> table.


The next two fields, Event_Node and Event_Details, are regex type entries ( perl regular expressions without the terminators // ), and used to match
on an event Node and Details fields - see L<Current Events|menu.pod/Current Events>.

=head2 Group

A list of Device Groups. Prefilled selection from nmis.conf 'Grouplist'. See L<Nodes Table|nodes.pod>.

=head2 Role

A list of pre-configured Device Roles. See L<Nodes Table|nodes.pod>.

Select one of "default", "core", "distribution", "access"

=head2 Type

A list of pre-configured Device Types. See L<Nodes Table|nodes.pod>.

Select one of "default", "router", "switch", "server", "generic"

=head2 Event

A list of pre-configured Events. See L<Event Policy Table|events.pod>.

Select one of "default", "Generic Down", "Generic Up", "Interface Down", "Interface Up",
									"Node Down", "Node Reset", "Node Failover", "Node Up",
									"Proactive Response Time Threshold",
									"Proactive Reachability Threshold",
									"Proactive CPU Threshold",
									"Proactive Memory Threshold",
									"Proactive Interface Availability Threshold",
									"Proactive Interface Input Utilisation",
									"Proactive Interface Output Utilisation",
									"Proactive Availability Threshold Interface",
									"Proactive Interface Input NonUnicast",
									"Proactive Interface Output NonUnicast",
									"RPS Fail",
									"SNMP Down", "SNMP Up"

=head2 Event_Node

A regex. Default entry is '.' - match all.	Matches the nodename in the L<Current Events|menu.pod/Current Events> table. 

	Some examples:
	
	^au - match all nodes starting with 'au'
	^au|^nz - match all nodes starting with 'au' and 'nz'
	^[^b]|^be|^bh - match all nodes that dont start with 'b', as well as 'be' and 'bh'

=head2 Event_Details

A regex. Default entry is '.' - match all.	Matches the event detail field in the L<Current Events|menu.pod/Current Events> table. 

=head2 Level0

Escalation at 5min Level0. Escalation time may be set in nmis.conf. If immediate notification is required, set Level0=0 time in nmis.conf. Level0 escalation supercedes 'mail=true' in L<Event Policy|events.pod>.

A keyword string that identifies a notification procedure, followed by one or more notification details.

Entries may be comma seperated - see examples.

Valid notification types as of V3.2.x are 

=over 4

=item * 

Netsend

	netsend:WKS1
	netsend:WKS1:WKS2

Send a Windows type popup message to a windows workstation, or list of workstations. For Linux, requires 'smbclient' to be installed on the NMIS server.

=item *

Email

	email:contact1
	email:syscontact
	email:contact1:contact2
	email:contact1:contact2:contact3

Send a notification email to the list of email addresses referenced by 'contact' in the L<Contacts|contacts.pod/Contact> table.

If the special keyword 'syscontact' is used, use the name gathered from the device 'sysContact' SNMP entry, as a reference into the L<Contacts|contacts.pod/Contact> table. 

	The email has the following format.
 	
	subject => 	node event - details at time 
	body => 	Node
			Notification at LevelX
			Event Elapsed Time: xxyy
			Severity: 	x
			Event: 		event
			Details:	event details
			http://		url link back to Current Events table.

=item *

Pager

	pager:contact1
	pager:syscontact
	pager:contact1:contact2
	pager:contact1:contact2:contact3

Send a numeric page using SNPP to the pager number contained in the field 'pager' in table L<Contacts|contacts.pod/Pager>.

If the special keyword 'syscontact' is used, use the name gathered from the device 'sysContact' SNMP entry, as a reference into the L<Contacts|contacts.pod/Contact> table.


=item *

CCopy

	ccopy:contact1
	ccopy:syscontact
	ccopy:contact1:contact2
	ccopy:contact1:contact2:contact3

Send a notification carbon copy mail to the list of email addresses referenced by 'contact' in the L<Contacts|contacts.pod/Contact> table.

If the special keyword 'syscontact' is used, use the name gathered from the device 'sysContact' SNMP entry, as a reference into the L<Contacts|contacts.pod/Contact> table.

	subject => 	COPY of Notification node event - details at time 
	body => 	FOR INFORMATION ONLY - THIS SHOULD BE DEALT WITH BY THE PRIMARY GROUP THAT IS CURRENTLY WORKING
			Copy of Notification at LevelX
			Event Elapsed Time: xxyy
			Severity: 	x
			Event: 		event
			Details:	event details
			http://		url link back to Current Events table.

=item *

Multiple notification procedure types may be comma seperated like this

	netsend:wks1,email:contact1:contact5,ccopy:contact4,pager:helpme

=back

=head2 Level1

Additional Escalation Levels.

15 mins

=head2 Level2

30 mins

=head2 Level3

40 mins

=head2 Level4

50 mins

=head2 Level5

1 hr

=head2 Level6

2 hrs

=head2 Level7

3 hrs

=head2 Level8

6 hrs

=head2 Level9

12 hrs

=head2 Level10

1 day

=head2 UpNotify

Set to 'false|true'. If set true, an UP event notification will be sent to the list of Contacts who received a 'down' event notification. This Policy entry key is stored in the Current Events table,
for this event, so that when the current event is cleared, this policy entry list of notification procedures is parsed again up to the current escalation level,
and all contacts notified, from Level0 to LevelX. 

This is subject to L<DutyTime|contacts.pod/DutyTime> rosters, so that only contacts who have a current DutyTime will receive the up notification.

=head1 Example

	Group Role Type Event Event_Node Event_Details Level0 Level1 Level2 Level3 Level4 Level5 Level6 Level7 Level8 Level9 Level10 UpNotify Add 
	default default default Node Down ^la . email:Helpme:LAX email:Contact1:Contact2 
	default default default Node Down ^bo . email:Helpme:BOR email:Contact1:Contact2 
	default default default Node Down ^cn . email:Helpme:CNR email:Contact1:Contact2 
	default default default Node Down ^cn . email:Helpme:SHG email:Contact1:Contact2 
	default default default Node Down ^hk . email:Helpme:HKG email:Contact1:Contact2 
	default default default Node Down ^us . email:Helpme,ccopy:US email:Contact1:Contact2
	default default default Node Down ^ds . email:Helpme email:Contact1:Contact2
	default default default Node Down ^tp . email:Helpme,ccopy:MGR email:Contact1:Contact2 
	default default default Node Down device10 .    email:ADMIN:Contact1:Contact2 
	default default default Node Down device14 .    email:ADMIN:Contact1:Contact2
	default default router Interface Down . .   GROUP1_mail
	GROUP1 default default Node Down ^[^b]|^be|^bh . netsend:WKS03:WKS04:WKS01 email:Contact1:Contact2
	GROUP1 default default Node Down device3 . netsend:WKS03:WKS04:WKS01 email:Contact1:Contact2
	GROUP1 distribution router Node Down device4 .  netsend:WKS01:WKS04:WKS03