An event is a record that something of interest has occurred—an alert has changed state, a maintenance window has been created, AWS instances have started or stopped, and so on.
The Wavefront CloudTrail integration retrieves EC2 event information and creates Wavefront System events that represent the EC2 events. See CloudTrail Integration.
To view events, select Browse > Events. The Events list displays. Here is an example event for the alert described in Tutorial: Getting Started fires:
Event Sources and Types
Events have three types of sources.
- System/Alert – When an alert fires or resolves, the source is System/Alert.
- System – When you perform actions in Wavefront, such as when you edit an alert or snooze an alert, or when newly affected sources fail or recover from an alert condition, the source is System.
- User You can manually create events with source User to identify user actions. For example, you can create an even for code pushes that occur outside Wavefront but that affect Wavefront metrics.
Events have types and subtypes, which are typically used in events queries.
Viewing System Event Details
To view details about an alert associated with a System/Alert event, click the View System Event and then View Alert links in the System/Alert event or the View Alert in a System event. You see a chart with the following queries:
- <Alert name> - the alert condition.
- Alert Firings - an events() query that shows events of type alert for the alert. These are events when alerts are open and are resolved.
- Alert Details - an events() query that shows events of type alert-detail for the alert. These are events when sources are failing or recovered.
- Alert Data - a query for alert metrics.
While some Wavefront instances can have hundreds of dashboards, typical Wavefront users use a smaller subset of dashboards each day. This makes the ability to quickly search for relevant dashboards vital. Wavefront offers many features to help you organize and search for dashboards.
A System event can be in the Ongoing or Ended state. System/Alert events are Ongoing until all affected alert sources are recovered and the alert is resolved, after which the state is Ended.
A User event can be in the Pending, Ongoing, or Ended state. A User event whose start time is in the future has the state Pending.
Creating a User Event
To create a user event:
- Do one of the following:
- Select Browse > Events and clicking the Create Event button located at the top of the filter bar.
- In a chart, click the flag icon located in the top right corner of the time bar. Hover over the chart and set your cursor at a point in time. To make the event instantaneous, click that point. If the start and end time for the desired event are included in the current time window, click, hold, and drag across the window.
- Fill in the event properties:
Property Description Name The name displayed on the Events page and when you hover over an event icon on the X-axis of a chart. Type The type of the event, such as code push. While there are no limitations to what you can enter into this field, try to limit it to type. You can enter additional information about the event in the Details field. You can enter the type as an event parameter in events() queries. Start Time The start time of the event:
- Now - The maintenance window starts immediately.
- - The maintenance window starts on the specified date and time.Click the text field and choose a date and time or type a date and time in the format MM/DD/YYYY HH:MM [AM|PM].
End Time The end time of the event:
- Instantaneous - End the event instantaneously with the start time. The exact interval is indeterminate. The Events page can report that the event starts and ends at exactly the same time or that it lasts a few seconds.
- Ongoing - The event does not have a specified end time. You can manually end (close) the event from the Events page.
- - End the event at the specified day and time. Click the text field and choose a date and time or type a date and time in the format MM/DD/YYYY HH:MM [AM|PM].
Classification The event classification: SEVERE, WARN, INFO, and UNCLASSIFIED. You can enter the classification as an event parameter in events() queries. Tags Tags to associate with the event. You can start typing the names of existing event tags and matching tags display or create new event tags. Details Additional details about the event. Display Event in Chart Displays only when creating an event from a chart. Whether to add an events(name=<name>) query to the chart so that the event displays.
- Click Save.
Deleting User Events
You can delete one or more user events by checking the checkboxes next to the events and clicking the Trash icon at the top of the Events page. The Trash icon is grayed out if any of the selected events cannot be deleted. To delete a single user event, select > Delete to the right of the event.
Closing an Ongoing Event
Ongoing events do not have an end time. To close ongoing events, check the checkboxes next to the events and click the Close button. The Close button is grayed out if any of the selected events cannot be closed. To close a single event, select > Close to the right of the event.
Managing Event Tags
See Organizing with Tags.