How alarms work
An alarm is a rule on one or more series. Cytometa Cloud checks it against the latest values and, when every condition is met, the alarm goes off: it opens an entry in its history and sends a notification. This page explains how that check works and what happens afterwards. The procedures are in Create an alarm, Suppress an alarm and Edit, disable or delete an alarm.
What an alarm watches
Section titled “What an alarm watches”Each condition of an alarm watches one series: one metric from one device, at one location,
under one tag. For example, Raw Water Intake – Total Cell Count from the BactoSense Intake,
tag raw. An alarm can combine series from different devices and locations.
A condition compares each value of its series with a Threshold using an Operator:
| Operator | A value meets the condition when it is |
|---|---|
> |
greater than the threshold |
< |
less than the threshold |
>= |
greater than or equal to the threshold |
<= |
less than or equal to the threshold |
= |
exactly equal to the threshold |
!= |
anything but the threshold |
Consecutive values (1 to 10) says how many values in a row must meet the condition. With 3, one high reading followed by a normal one does nothing; three high readings in a row count.
The anchor condition
Section titled “The anchor condition”The first condition is the anchor. It is met when the latest values of its series, as many as Consecutive values, all meet the operator and threshold. The time of the newest of those values is the moment the other conditions are judged against.
An alarm with one condition goes off as soon as its anchor is met.
The correlation window
Section titled “The correlation window”Every further condition has a Correlation window of ±1 to ±30 minutes. The condition is met when its own series has as many values in a row as its Consecutive values meeting its threshold, somewhere between that many minutes before and that many minutes after the anchor’s newest value. The alarm goes off only when the anchor and every further condition are met.
Example. An alarm watches for high cell counts at the intake while the water is turbid:
| Metric series | Operator | Threshold | Consecutive values | Correlation window | |
|---|---|---|---|---|---|
| Anchor condition | Raw Water Intake – Total Cell Count | > |
400000 | 2 | — |
| Condition 2 | Raw Water Intake – Turbidity | > |
0.4 | 2 | ±15 minutes |
| Time | What arrives | Result |
|---|---|---|
| 09:30 | Cell count 412,000 (the previous one was 380,000) | Only one value above 400,000 in a row. Not met. |
| 10:00 | Cell count 431,000 | Two in a row: the anchor is met at 10:00. The window runs from 09:45 to 10:15. |
| 10:00 | Turbidity 0.45 at 09:45, 0.47 at 10:00 | Two values above 0.4 in a row inside the window: condition 2 is met. The alarm goes off. |
Had the turbidity stayed at 0.3, the alarm would not have gone off, however high the cell count. It would then have counted as not met, and an alarm that was going off would resolve.
When alarms are checked
Section titled “When alarms are checked”Cytometa Cloud checks every enabled alarm in the workspace about once a minute, against the values that have arrived by then. A new value is therefore picked up within a minute or so of arriving.
An alarm is judged only on fresh data: when the newest value of the anchor’s series is more than 15 minutes old, the check is skipped and the alarm stays in whatever state it was in. It does not resolve because data stopped. See When the data stops.
The states
Section titled “The states”Each time an alarm goes off it opens a new entry in its history. The entry has one of four states:
| State | It means |
|---|---|
| Alerting | The conditions are met. The alarm is going off. |
| Suppressed | Someone suppressed the entry for a set time. |
| Resolved | The conditions were no longer met, and the entry closed. |
| Stale | The entry was closed because no fresh data confirmed it for 24 hours. |
An alarm has at most one Alerting entry at a time. While it stays met, the check confirms the open entry; it does not open another one or send another notification. Resolved, Stale and Suppressed entries do not change again. The next time the conditions are met, a new entry starts.
How an alarm moves between states
Section titled “How an alarm moves between states”| From | Event | To | Notification |
|---|---|---|---|
| — (normal) | Every condition is met | Alerting (a new entry) | Alarm triggered (ERROR) |
| Alerting | A check on fresh data finds a condition not met | Resolved | Alarm resolved (INFO) |
| Alerting | An Operator, Manager or Admin suppresses it | Suppressed | Alarm suppressed (INFO), with the end time |
| Alerting | 24 hours without a check that confirms it | Stale | Alarm stale (WARNING) |
| Suppressed | The suppression ends and the conditions are still met | stays Suppressed; a new Alerting entry starts | Alarm triggered |
| Suppressed | The suppression ends and the conditions are not met | stays Suppressed; nothing else happens | none |
What suppression does and does not do
Section titled “What suppression does and does not do”Suppression is for an alarm you already know about, such as work on site or a sensor being replaced. See Suppress an alarm.
It does:
- stop all checks of the alarm until the chosen time (30 minutes to 24 hours), so it cannot go off again, whatever the values do;
- tell the workspace, with an Alarm suppressed notification that says until when.
It does not:
- apply in advance. Only an Alerting entry can be suppressed;
- resolve anything. The suppressed entry stays Suppressed for good, and there is no Alarm resolved when the problem goes away;
- stop at a time other than the one you chose. It cannot be shortened, extended or canceled;
- touch other alarms on the same series. Each alarm is suppressed on its own.
When the data stops
Section titled “When the data stops”An alarm can only judge data that arrives. When the newest value of its anchor series is more than 15 minutes old, or a further condition has too few values in its window, the alarm is not checked and keeps its state:
- A normal alarm stays normal. It cannot go off on missing data.
- An alerting alarm stays Alerting. It does not resolve.
An Alerting entry that no check has confirmed for 24 hours is closed automatically: it becomes Stale and an Alarm stale notification goes to the workspace. The message says that no metric data has been received for over 24 hours.
A stale alarm says nothing about water quality. It points at the instrument, its router or the connection: check the device on Devices. When data comes back and the conditions are still met, the alarm goes off again as a new entry.
Disabled alarms
Section titled “Disabled alarms”A Manager or Admin can disable an alarm. A disabled alarm is not checked, cannot go off and sends nothing. Its history is kept. See Edit, disable or delete an alarm.
Disabling does not close an entry that is Alerting at that moment. Because the alarm is no longer checked, that entry becomes Stale after 24 hours, with an Alarm stale notification. When you enable the alarm again, it is checked from the next minute on.
Editing an alarm changes its conditions from the next check. Entries already in the history keep the values that were recorded against the old conditions.
Who is told
Section titled “Who is told”Every alarm notification goes to the workspace:
- In the app, everyone in the workspace, from Viewer to Admin, sees it under the bell and on Notifications, with Show alarm to open the alarm. See Notifications.
- By email, only the people who have switched on that type (Alarm triggered, Alarm resolved, Alarm suppressed or Alarm stale) under Email Preferences in that workspace. Nobody is subscribed by default. The subject is the notification’s title and the email is in the recipient’s language. See Choose email notifications.
The notification names the alarm and, from its anchor condition, the metric, device, location and tag. Alarm triggered also gives the anchor’s newest value and the threshold.