Rules are executed in order, top to bottom. The alarm has been cleared is a special condition. When an alarm is cleared then only rules matching that condition will be executed.

For any given rule, ALL the actions are taken when ALL the conditions are met

The conditions and actions may vary with the connection type.

For all alarms
where the connection type is one of os/vmware, os/windows
    send Push Notification to helpdesk@company com

For all alarms
where the connection type is database/sqlserver
    send Push Notification to dbagroup@company com

The requirements may depend on the day of the week.

For all alarms
where the day of the week is Sunday
      and the alarm severity is High
    send email to jsmith@company.com

For all alarms
where the day of the week is Saturday
      and the alarm severity is High or Medium
    send email to jsmith@company.com

Stop processing further rules

Rules are executed in order, top to bottom. A useful action to incorporate is stop processing further rules.

When the following two rules are executed in order an email is sent if the alarm severity is low on Sunday or Saturday. Reverse the execution order of these two rules and an email is sent for every alarm raised with low priority.

For all alarms
where the alarm severity is Low
      and the day of the week is Monday, Tuesday, Wednesday, Thursday or Friday
    stop processing further rules

For all alarms
where the alarm severity is Low
    send email to jsmith@company com

The alarm has been cleared

When an alarm is cleared then only rules matching that condition will be executed.

So for the following two rules, the first rule is ignored when the alarm has been cleared - an email is sent for every alarm that has been cleared including if one of the three alarms listed by the first rule is cleared.

For all alarms
where the alarm is not one of CPU - Average CPU Usage, CPU - Individual CPU Usage, CPU Processor Queue Length
    stop processing further rules.

For all alarms
where the alarm has been cleared
    send e-mail to jsmith@company.com

The connection is…

Where the alarm severity is…

When combining The alarm severity is… and The Connection is… conditions and a severity is repeated, order the rules with the highest severity first and lowest severity last. Add the Stop processing further rules action to the last rule in the list.

For all alarms
where the connection is M601\SQLK8
      and the alarm is Backup - Days Since Last Full Backup
 and the alarm severity is High
   send email to jsmith@company com


For all alarms
where the connection is M601\SQLK8
      and the alarm is Backup - Days Since Last Full Backup
 and the alarm severity is Medium or High
   send email to dbrown@company com
 and stop processing further rules

Where the alarm is…

When multiple rule(s) apply to the same alarm, rules with The Connection is… condition should be ordered before rules that don’t have The Connection is… condition.

For all alarms
where the connection is M601\SQLK8
      and the alarm is Backup - Days Since Last Full Backup
   send email to dbrown@company com
 and stop processing further rules

For all alarms
where the alarm is Backup - Days Since Last Full Backup
   send email to jsmith@company com

Following is what the list may look like in the list of rules, where the rule name is the name of the alarm (when the alarm applies to all connections) and the name of the alarm for connection (when the rule applies to the alarm on a specific connection)

Backup - Days Since Last Full Backup for M601\SQLK8
Backup - Days Since Last Full Backup for M605\SQLK8
Backup - Days Since Last Full Backup

Stop processing further rules

Consider adding the Stop processing further rules action.

In this example an email is sent to jsmith every time the Backup - Days Since Last Full Backup alarm is raised. In addition, an email is sent to dbrown when the alarm is raised on connection M601\SQLK8.

For all alarms
where the connection is M601\SQLK8
      and the alarm is Backup - Days Since Last Full Backup
   send email to dbrown@company com


For all alarms
where the alarm is Backup - Days Since Last Full Backup
   send email to jsmith@company com

In this example an email is sent to jsmith every time the Backup - Days Since Last Full Backup alarm is raised - except when the alarm is raised on connection M601\SQLK8. An email is sent to dbrown (instead) when the alarm is raised on connection M601\SQLK8.

For all alarms
where the connection is M601\SQLK8
      and the alarm is Backup - Days Since Last Full Backup
   send email to dbrown@company com
 and stop processing further rules

For all alarms
where the alarm is Backup - Days Since Last Full Backup
   send email to jsmith@company com