Monitoring alerts

Monitoring tools (server, network, backup monitors) can send their alerts to ServAIceDesk. Each tool is a monitoring source, added by an admin under Settings › Channels, with its own signed address so only that tool can post to it. Open alerts and their incidents appear under Monitoring & security › Monitoring.

From alert to incident

• An alert that a condition is open (for example “CPU above 95% on app-01”) creates an incident, with the source's default service and the alert's details.
• While the same condition keeps being reported, every report attaches to that same incident; no duplicates are opened.
• A recovered alert marks the condition recovered on the incident. Someone still confirms and resolves the incident.
• If the condition fires again shortly after its incident was resolved (within an hour by default), that incident is reopened instead of a new one being created.
• A condition that keeps going up and down (5 changes in 30 minutes) is treated as flapping and consolidated into one incident.

Alerts are matched by their correlation key, or by the resource they are about, so the same failure is recognised across reports.

Maintenance windows

During planned work, add a maintenance window for a source, service or resource. Alerts that arrive inside it are kept as evidence but do not open incidents.

Suppression rules

To permanently ignore alerts you never act on (a test check, a noisy metric), add a suppression rule matching the source, alert type, severity or resource. Suppressed alerts are still recorded.