Notifications (Alerts) about Network Events

The CoPilot Notifications page enables you to configure alerts so that you can be notified about changes in your Aviatrix transit network, see all triggered alerts, pause alerts, and set preferred notification channels for receiving alerts.

Working with Notifications

You access Notifications in CoPilot from Monitor > Notifications or by typing Notifications in the navigation search.

When alert conditions are met for a metric, Copilot records the event in the Monitor > Notifications > Alerts page. This page is a tabular view of Aviatrix platform triggered alerts, with search and filter capability.

How you set a condition threshold to trigger an alert depends on different factors. Work with your network operations team to determine the metric conditions that will trigger alerts in your environment. For example, for system metrics, the instance size can influence what condition threshold makes sense. For metrics associated with cloud provider-maintained infrastructure, the desired condition threshold may vary between cloud service providers.

Alerts can be based on events such as changes in telemetry data for managed resources. For example, you can receive a notification when the total memory of a gateway instance falls below a specified threshold. The alerts can also be based on the status of a resource or connection. For example, when a gateway or gateway connection goes from an up to down status. See Configuring Alerts.

CoPilot supports webhook alerts. Webhooks allow you to send notifications to third-party automation systems such as Slack. You can send a webhook to any system that can take an HTTPS callback. A single alert can notify multiple systems/people. For information on how to customize the webhooks CoPilot generates, see Setting Up Webhook Channels for Sending Alert Notifications.

You can pause alerts. You may want to pause alerts before performing maintenance tasks on the network that will trigger pre-configured alerts and then unpause them when the maintenance is complete. See Pausing Alerts.

In Monitor > Notifications, CoPilot lists all alerts and shows if they are in a triggerd (open) or closed state. You can open an alert from the list to view its lifecycle. CoPilot closes the alert automatically when the alert metric no longer meets the condition to trigger the alert. The alert lifecycle provides a history for every alert that happens in your network environment. See Viewing Alert Notifications.

See also CoPilot Notifications Page Reference for descriptions of each tab available under Notifications and the views they provide.

About Metrics used for Triggering Notifications

For Aviatrix Controller and Aviatrix gateways, you can configure alerts to be notified to events that occur in your network such as performance bottlenecks or other problems. You configure alerts and the channels to be notified using the notifications feature in Aviatrix Copilot. For information about the system and network metrics on which notifications can be based, see Metrics Monitored for Aviatrix Resources.

CoPilot Alert Condition Display Names

The following is a list of all alert condition display names shown by CoPilot.

Many of the alerts are associated with detecting changes in resource utilization (telemetry) data for managed resources.

Some alerts are associated with enhanced security services such as detecting network anomalies or detecting threat IPs identified by a well known threat-IP source.

"Processes Waiting To Be Run"

"Processes Uninterruptible Sleep"

"System Interrupts"

"System Context Switches"

"Swaps To Disk"

"Swaps From Disk"

"IO Blocks IN"

"IO Blocks OUT"

"Memory Cache"

"Memory Buffer"

"Memory Swapped"

"Memory Free"

"Percent Memory Free"

"CPU Idle"

"CPU Wait"

"CPU User Space"

"CPU Kernel Space"

"Disk Free"

"Percent Disk Free"

"Disk Total"

"CPU Steal"

"Transmitted Rate"

"Received Rate"

"Total Rate"

"Peak Transmitted Rate"

"Peak Received Rate"

"Peak Total Rate"

"Received Bytes"

"Compressed Packets Received"

"Packets Dropped While Receiving"

"Errored Packets Received"

"Receiver FIFO Frames"

"Received Frames"

"Multicast Packets Received"

"Received Packets"

"Transmitted Bytes"

"Transmitted Carrier Frames"

"Collisions during Transmission"

"Compressed Packets Transmitted"

"Packets Dropped during Transmission"

"Errored Packets Transmitted"

"Transmission FIFO Frames"

"Transmitted Packets"

"Bandwidth Ingress Limit Exceeded"

"Bandwidth Egress Limit Exceeded"

"PPS Limit Exceeded"

"Conntrack Limit Exceeded"

"Linklocal Limit Exceeded"

"Packets Transmitted Rate"

"Packets Received Rate"

"Total Rate (in packets)"

"Compressed Packets Received Rate"

"Rate of Packets Dropped While Receiving"

"Errored Packets Received Rate"

"Receiver FIFO Frames Rate"

"Received Frames Rate"

"Multicast Packets Received Rate"

"Transmitted Carrier Frames Rate"

"Collisions Rate during Transmission"

"Compressed Packets Transmitted Rate"

"Rate of Packets Dropped during Transmission"

"Errored Packets Transmitted Rate"

"Transmission FIFO Frames Rate"

"Bandwidth Ingress Limit Exceeded Rate"

"Bandwidth Egress Limit Exceeded Rate"

"PPS Limit Exceeded Rate"

"Conntrack Limit Exceeded Rate"

"Linklocal Limit Exceeded Rate"

"Gateway Status"

"Tunnel Status"

"BGP Peering Status"

"Underlay Connection Status"

"Threat IP Detected"

"Anomaly Detected"

"Scaling Recommendation triggered"

Underlay Connection Status Alert

The Underlay Connection Status alert indicates a potential underlay communication issue. Potential causes of this alert include the following:

  • A CSP link outage.

  • A misconfigured security group or ACL.

  • A firewall blocking traffic.

  • A router dropping packets.

This alert applies to connections between hosts running Aviatrix gateways.

Monitored hosts will alert on syslog traffic where it is the source or the destination

When you set this alert for a host(s), CoPilot monitors the syslog from any connection that includes the host as the source or destination. When syslog data indicates a potential problem from each direction of the connection between that host and another host within 30 seconds of the other, the alert is triggered. On the same connection, if the syslog data later indicates the problem is resolved from either direction, the alert is automatically resolved.