Alert Suppressions & Silences

This article discusses the Alert Suppressions & Silences page in the Kentik portal.

Tip: For more information about Kentik’s Alerting system, see Alerting and Alert Policies.

About Alert Suppressions & Silences

The Alert Suppressions & Silences Page enables you to temporarily mute alarms and avoid notifications or mitigations for Kentik alerts. The distinctions between alert suppressions and silences are detailed below:

Alert Suppressions

• Stop all alerts for a given pattern (see Pattern List)

• Prevent alerts from being generated entirely

• Block both notifications AND mitigations

• Can be enabled by policy, pattern, or alert (see Alert Suppression Methods)

• Start 20 minutes after creation

Alert Silences

• Stop notifications for a specific alert only

• Alert is still generated in the portal, just not communicated

• Only block notifications (not the alert itself)

• Applied to specific alerts (e.g., 7-day silence initiated from alert details)

• Can only be deleted from the Alert Suppressions & Silences page

Summary: Suppressions prevent the alert from existing, while silences let the alert exist but mute notifications about it.

Alert Suppression Methods

Alert suppressions can be enabled in three ways:

• By Policy: Use the Suppress Alerts switch on the General Policy Settings tab of the Edit Policy or Add Policy page to enable alert suppression for that policy and specify a date after which that suppression should end.

  Note: This option is not present in NMS Policy Settings.

• By Pattern: The Alert Suppressions & Silences Page enables you to define patterns that, when matched in traffic that would otherwise trigger an alarm, instead causes the alarm to be muted. Each pattern has a specified expiration date, on which alerting will no longer be muted on the matching set of traffic. A pattern is similar to a key (a unique combination of values for a given set of dimensions (see About Keys), but a pattern may be set to use:

  • A partial condition(s) match (see Pattern Dialog UI).

  • An exact condition(s) match.

  • A policy match.

• By Alert: On the Alerting page, you can silence for seven days any keys that match a specific alert:

  • On an alert in the Alerts List, click the vertical ellipsis button at the far right to open the drop-down menu, then click Suppress Alert.

  • On the Alert Details Drawer, under Take Action, click the Suppress Alert button.

Notes:

• Alert suppressions start 20 minutes after creation time.

• Patterns are independent of policies. A given pattern may match traffic covered by two or more policies.

Alert Suppressions & Silences Page

The Alert Suppressions & Silences page displays a list of all alert suppressions and silences for your organization, collectively known as patterns (see Pattern List). Use this page to add, edit, and remove alert suppressions and/or to remove alert silences from the list. The page has the following UI elements:

• Show: Click the button to select which patterns to display in the list: All, Active, or Expired.

• Search Patterns: Enter text to filter the list to patterns with that text in the Comment column.

• Add Suppression Pattern: Click to open the Add Suppression Pattern dialog (see Pattern Dialogs), where you can configure and save a new pattern.

• Pattern List: A table of all the patterns in your organization (see Pattern List).

Notes:

• For information on configuring a pattern, see Pattern Dialogs.

• For information on configuring alert suppressions for an alert policy, see General Policy Settings.

Pattern List

The Pattern List shows all the alert suppressions and silences that exist for your organization, and provides the following information/actions for each:

• Type: Indicates whether the list item is a silence or a suppression, e.g., “Silence”.

• Pattern: The pattern's match type and conditions (dimension/value pairs) or policy as defined in the Add Pattern or Edit Pattern dialog (see Pattern Dialogs).

• Comment: The comment, if any, entered for the pattern when it was added or edited.

• Created: The date on which the pattern was added.

• Started/Starts In: The date on which the pattern started (if in the past) or starts in (if in the future)

• Expires: The date on which the pattern expires, meaning that alarms on matching traffic will no longer be muted.

• Edit (pencil icon): Opens the Edit Pattern dialog, where you can edit or remove the pattern.

• Remove (trash icon): Opens a confirming dialog that allows you to delete the suppression/silence.

Pattern Dialogs

Patterns are defined in the pattern dialogs (Add Suppression Pattern or Edit Suppression Pattern):

• Add Pattern: To add a new pattern, open the dialog with the Add Suppression Pattern button at the upper right.

• Edit Pattern: To edit an existing pattern, click the Edit icon (pencil) in that pattern's row in the Pattern List.

Pattern Dialog UI

The Add Suppression Pattern and Edit Suppression Pattern dialogs share the same layout and the following common UI elements:

• Close button: Click the X in the upper right corner to close the dialog. All elements will be restored to their values at the time the dialog was opened.

• Cancel button: Cancel the add pattern or edit pattern operation and exit the dialog. All elements will be restored to their values at the time the dialog was opened.

• Add Suppression Pattern button (Add Suppression Pattern dialog only): Save settings for the new pattern and exit the dialog.

• Save button (Edit Suppression Pattern dialog only): Save changes to pattern settings and exit the dialog.

Pattern Dialog Settings

The following settings are configured in the Add Suppression Pattern and Edit Suppression Pattern dialogs:

• Pattern Type: A drop-down menu from which to choose one of the following pattern types:

  • Match Conditions: The pattern is matched if all (exact match) or some (partial match) of the conditions listed in the Conditions section are matched.

  • Match NMS Conditions: The pattern is matched if all (exact match) or some (partial match) of the conditions listed in the NMS Conditions section are matched.

  • Match Policy: The pattern is matched if traffic matches the criteria of the selected policy.

• Suppression Window (appears when the Never Expire switch is Off): A field that shows the period during which alarms on matching traffic will be muted. When clicked, the field expands into the Suppression Window Controls.

• Start Time (appears when the Never Expire switch is on): A field that shows date-time from which the pattern will be muted. Clicking the field opens a calendar in which you can set the date-time.

• Never Expire: A switch that, when on, removes the end of the silence window, thereby keeping the pattern active indefinitely.

• Comment: Any text that will make clear to others in your organization why the pattern was created. This text also allows you to filter the Patterns List later using the Search Patterns field.

• Conditions (appears when Match Conditions is selected): A list of the conditions that make up this pattern (see Pattern Conditions List).

• Add Condition: Button that appears either when Match Conditions is selected, or when Match NMS Conditions is selected and a measurement value is selected. Clicking the Add Condition button adds another row to the Conditions list.

• Policy (appears when Match Policy is selected): A drop-down menu from which to choose a policy for the pattern.

Suppression Window Controls

The following controls, which open by clicking the Suppression Window field, are available to set the suppression window:

• Start and End Date: Input fields that show the start and end date-times of the suppression window, which may be entered either using the calendar or directly in the datetime format YYYY-MM-DD HH:MM.

• Calendar: A popup in which you can click to set the start and end date-times.

• Apply: A button to set the suppression window to the date-times specified in the Start Date and End Date fields.

• Cancel: A button to leave the suppression window as it was before the controls were opened.

Note: Alert suppressions start 20 minutes after creation time.

Pattern Conditions List

The Conditions list is a set of key/value pairs in which the key is a dimension. The Include statement for the conditions may be either of the following:

• Exact Match (default): The pattern is matched if all the conditions specified in the Conditions section are matched.

• Partial Match: The pattern is matched if any of the conditions specified in the Conditions section are matched.

Each row of the Conditions list is a condition whose operator is always "equals" and whose other characteristics are defined by the following settings:

When Match Conditions is selected on the Pattern Type drop-down:

• Dimension: Click on the listed dimension to open a popover menu from which you can choose a dimension. See Dimension Selection Groups for descriptions of the available options in this popover.

• Direction button: A button to the right of the dimension selector that appears only for dimensions that exist for both source and destination. The button toggles the perspective of the dimension between those directions.

• Value: The value of the dimension. Click on the field to see a drop-down list of options, when available. Filter the list by entering text in the Filter Options field at the top of the drop-down.

• Remove: Click the red X to remove the condition from the list.

When Match NMS Conditions is selected under the Pattern Type drop-down menu:

• Measurement: this field is shown by default and is not editable.

• Value: The value of the measurement to be matched for this condition. Click on the field to see a drop-down list of options.

• Remove: Click the red X to remove the condition from the list. This button is only visible when multiple NMS Conditions are on the list. To remove a lone condition without saving, either select another option from the Pattern Type drop-down menu or click the Cancel button.

Note: For each successive NMS Condition added to the list, the available options in the drop-down menu on the left will vary depending on the measurement value selected in the first (top-most) condition.