1. Managing Alerts

Ambari predefines a set of alerts that monitor the cluster components and hosts. Each alert is defined by an Alert Definition, which specifies the Alert Type check interval and thresholds. When a cluster is created or modified, Ambari reads the Alert Definitions and creates Alert Instances for the specific items to watch in the cluster. For example, if your cluster includes HDFS, there is an alert definition to watch the "DataNode Process". An instance of that alert definition is created for each DataNode in the cluster.

	Note
	Refer to List of Predefined Alerts for a list of the alerts that are configured by Ambari by default.

Using Ambari Web, you can browse the list of alerts defined for your cluster under the Alerts tab. You can search and filter alert definitions by current status, by last status change and the service the alert definition is associated with among other things. Click on the alert definition name to view the details about that alert, modify the alert properties (such as check interval and thresholds) and the list of alert instances associated with that alert definition.

Each alert instance reports an Alert Status defined by severity. The most common severity levels are OK, WARNING, CRITICAL but there are also severities for UNKNOWN and NONE. Alert notifications will be sent on alert status changes (for example, going from OK to CRITICAL). See Configuring Notifications for more information about notifications.

Modifying an Alert

General properties for an alert include Name, Description and Check Interval. The Check Interval defines the frequency Ambari will check the alert status. For example, a "1 minute" interval means Ambari checks the alert status every "1 minute".

The configuration options for thresholds depend on the Alert Type. See Alert Types for more information.

Enabling or Disabling Alerts

You can optionally disable alerts. When an alert is disabled, no alert instances are in effect and Ambari will no longer perform the checks for the alert. Therefore, no alert status changes will be recorded and no notifications (i.e. no emails or SNMP traps) will dispatched.