Editing Rules

On the Projects page (Performance Manager > Projects), click the project for which you want to edit a rule.

On the Rules tab (Performance Manager > Configuration > Rules), click the rule you want to edit. The Configure Rule - Create Condition Expression page appears. This page allows you to combine conditions and operators into rules.

Select a preconfigured condition from the Condition list. A description of the selected condition appears to the right of the list box.

Note: If the rule you are configuring involves multiple conditions, click Add New Expression Part to add a new Condition list and an Operator list. You can then use the up-and-down Move arrows to move the conditions within the expression. To delete a condition from the expression, click the corresponding Delete button.

Specify a frequency interval that will trigger an incident: All the time, 75% of times, 50% of times, 25% of times, or Once within an interval of 15 minutes, 30 minutes, 45 minutes, 1 hour, 4 hours, 6 hours, 8 hours, 12 hours, 16 hours, or 1 day. Alternatively, use the Raise incident if the expression is true <x> times in series option to configure the rule to raise incidents after a certain number of consecutive failures, independent of any time frame. The specified frequency interval begins as soon as you save the rule. Time intervals are used rather than numbers of executions because conditions may come from different transactions with differing schedules. To illustrate how condition frequency factors into rule expressions, consider a monitor schedule interval of 1 minute and a rule expression that raises an incident if the expression is true All the time within an interval of 15 minutes. In such an instance an incident will only be raised if the expression is true 15 times in a row-and the incident will not be raised until the 15 minute interval has concluded.

If 50% of times is selected, an incident will be raised if the expression is true 8 of the 15 minutes.
If Once is selected, an incident will be raised whenever the expression is true-regardless of whether the interval has concluded.

Condition frequency must also be considered when applying a rule to multiple monitors. Assume that we have a single rule with 2 conditions using OR logic and the frequency set to 2 times in a series and this rule applies to two monitors that run alternately. If the first monitor always fails and the second monitor always succeeds, the rule will never trigger because after every failure of monitor 1, monitor 2 reports a success, so the 2 times in a series frequency may not deliver the desired result for this scenario. A time-based frequency or multiple rules need to be used in this case.

Click Next. The Configure Rule - Rule Name page appears.

Enter a name for the rule in the Rule Name field.

Select an appropriate severity for the rule from the Severity list:

Informational: This is the lowest severity and is color-coded blue. This severity is used to mark incidents that do not indicate system problems. Although it can be used for rules, it is more likely to be used for custom incidents (for example, maintenance work or invalid results).
Warning: Color-coded yellow, this severity is used to define lower thresholds and offers early warning of potential problems. This is less likely to be used for custom incidents.
Error: Color-coded red, this severity is used for critical thresholds when immediate action is required. This severity is not likely to be linked to a log only action.
Service Target Violation: This severity is also color-coded red. This is a special type of error that is used as the basis for service target agreement statistics calculation. When a service target incident is active, a system is considered to be in a state where the service target of the service provider is in violation of agreed upon quality standards (for example, response times or availability). Service target statistics include:
- # Violations: Number of times the service target is violated during the relevant interval
- Average duration: Average duration of service target violations
- Downtime: Percentage of time service target is violated during a time interval
- Uptime: 100% minus Downtime%
- MTBF (mean time between failure): Average time from the end of one violation to the beginning of the next violation.
  Example:
```
Time interval is 01:00 AM - 11:00 AM
Violation 1: 2:00 - 4:00 AM
Violation 2: 3:00 - 5:00 AM (based on a different rule)
Violation 3: 7:00 - 8:00 AM
```
  This results in:
```
# Violations: 2 (the overlapping violations are counted as a single incident)
Avg. duration: 2 hours (3 hours and 1 hour divided by 2)
Uptime: 60% (4 hours of downtime in 10 hours)
MTBF: 3 hours (6 hours uptime / 2 incidents)
```

Specify the action that is to be taken when incidents occur. See Configuring Rule Actions for details.

Click Next to return to the Rules page.