Managing events goes hand in hand with thresholds and notifications. We have created 3 videos in a series about this and would recommend that you watch all three of these videos.

Following the videos is some of the transcript of the videos specifically pertaining to event management and the alarm manager. You can read through this text to ensure you haven’t missed anything in the videos.

Happy watching!

Alarms and Events

Alarm Manager

Iris Notifications

Alarms and severity

One of the key concepts in Iris is that this system is status-based. This means that a particular element has one or more alarms associated with it. Each of these alarms has a severity associated with it. The severity can range from clear, which means that there is no problem, to warning, error, critical, and finally down, which is the most severe.

Each element in Iris may have multiple alarms associated with it and each of these can be in various states. The state of the element is determined by the worst severity.

If, for some reason, the element has no alarms associated with it, even if clear, then the state of the element is said to be unknown.

Alarms being associated with an element simply means that it is being monitored. The majority of the alarms are clear and not actual issues. Only alarms which have a severity of warning and above, actually appear in the alarm manager. It is possible to show the clear alarms, as it is sometimes useful to know whether an element is being monitored or not.

Usually when we talk about alarms, in every day terms though, we mean alarms of warning severity and above. See the example below.

Alarms vs events

It is important to differentiate between alarms and events in Iris.

Alarms refer to a current state whereas events refer to something that happened at a specific time. For example, if an interface went down and then came up again, the current state would be clear but there would two events indicating that the state changed twice.

As you can see, the alarm state is on the top. Every time the state changes, an event is logged.

Events, just like alarms, also have severities which correspond almost exactly the same as with the alarm severities. CLEAR is sometimes referred to as INFO as well. And, there is a log and debug severity which is used to just log information that is not relevant to a state change.

Here are some examples of events from the event log.

How alarms are generated

There are 3 main sub-systems which generate events in Iris.

1. Active Monitoring: these include ICMP monitoring, SNMP status monitoring and TCP port monitoring

2. Syslogs and SNMP traps which come directly from devices

3. Thresholds: which breach on graph data values

First failure is warning, then critical and the third and subsequent failures are all down.

Iris Certified Engineer (ICE) Level 1, 2 and 3

We offer certification exams for all users and administrators. Tracks have been developed to cover the content for each of the levels. To register to be an ICE, please email

For the next article, click on the track that you are following:

TRACK 2: Service Manager

TRACK 3: Administrator

To return to the contents page, click on the track that you are following:

TRACK 2: Service Manager

TRACK 3: Administrator