Notification policies, escalation and maintenance windows

A policy decides who is told about which ticket, and how. It has three parts: what it matches, whom it tells, and how it repeats and escalates. Policies belong to an organisation and are managed by its administrators under Settings → Notifications → Policies.

What a policy matches

• From severity: warning, serious (the default) or critical.
• Categories: none ticked means all. The categories are Not responding, Slowdown, Errors, Resources, Network, Visitor experience, Security and Scanning.
• Scope: chosen machines, applications or IoT devices, or "a team's things", meaning everything a team was granted. Nothing ticked means everything the organisation owns.

Whom it tells

A policy can name people, teams and channels in any mix. People who switched their alert mail off, whose accounts are blocked, or who left the organisation are skipped. When several policies match one ticket, each recipient still gets one notice per event.

How

• Do not repeat the same thing within (minutes): 360 by default, up to a week.
• Also say when it resolves: off by default.
• Escalate after (minutes still open and not acknowledged), with an Escalation ring. Leave it empty to never escalate.

Escalation

Every minute, open tickets are checked against their policies. If a ticket is still open after the escalation time and nobody has acknowledged it, the escalation ring is told once: "Still open after N min, not acknowledged". If nobody in the ring can be reached, that failure is recorded in the delivery log. Pressing Acknowledge on the ticket stands the ring down. See Acknowledging and closing.

On-call rotations and quiet hours are not part of policies yet.

Who would be told

You should not have to wait for a real outage to know whether a policy works. The Who would be told card tries a ticket against your policies before you save anything. Pick a severity, a kind and a machine, or use a real ticket, and press Try. Each policy answers fires or quiet. A quiet policy gives its reason, such as "below serious". A firing one lists who it would tell, including who the escalation would reach after N minutes.

The delivery log

Delivery log lists recent deliveries, newest first. Each row shows when, the ticket, the event (opened, escalated, escalation ring, resolved or digest), the recipient, the policy that caused it, and the result. It answers "why did I get this", and "why didn't I".

Maintenance windows

For one machine

On a host's page, 🔧 Maintenance silences that machine for 1 hour, 1 day, 1 week, or until a time you choose, up to 90 days. You can give a reason, which is shown while it lasts. During the window no email, webhook, policy, personal or workflow delivery goes out about the machine, neither for openings nor for closings. Tickets still open and record. When the window ends, tickets that opened during it and are still open are sent then. A banner on the host's page shows the window, with End now.

For the whole install

On the notifications card, Silence everything for a while asks for a number of hours (four by default) and a reason, up to seven days. This is for the install's administrator. It stops channel, policy and personal problem mail. It does not stop escalations, workflows or the daily summary. Tickets still open and record, and nothing held back is re-sent afterwards. End it now lifts it.

Muting by name

For something that should never wake anybody, such as a staging box, Mute it by name is permanent rather than a window. See Notification channels.

Beyond notifications

A policy sends a message. To do something more when a ticket opens, such as wait, branch, enrich it, ask a model or call your own API, draw a workflow.