How to configure per-profile alert delays for specific services in the ntservices probe

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

There is a requirement to increase the alert delay for specific services (such as Crowdstrike and Splunk) to 20 minutes (1200 seconds) within the ntservices probe.

The current interval threshold is set to 10 minutes (600 seconds). Modifying the interval directly within the probe applies the 20-minute delay globally to all profiles. The goal is to isolate this delay specifically to Crowdstrike and Splunk across multiple servers without altering the alerting threshold for other monitored services.

Environment

DX UIM: All supported versions.
ntservices probe up to version 4.02

Resolution

The ntservices probe does not support per-profile "time intervals".

Workaround is to use NAS AO profile to delay the alaerts.

You can isolate the Crowdstrike and Splunk alerts by creating a targeted Auto-Operator (AO) profile within the nas probe to manage the delay.

Configuration Steps:

1. Open the nas Probe:

   • Open the nas probe configuration GUI.

   • Navigate to the Auto-Operator -> Profiles tab.

2. Create a New Profile:

   • Right-click in the profiles area and select New.

   • Give the profile a descriptive name (e.g., Delay_Crowdstrike_Splunk_Alarms).

3. Define Matching Criteria:

   • Probe: Set this to ntservices so the rule only targets alarms coming from the services probe.

   • Message String: Use a pattern or regex to isolate the specific services (e.g., *Crowdstrike* or *Splunk*).

4. Configure the Action and Time Delay:

   • Action Type: Select your intended delivery method, such as EMAIL or SCRIPT.

   • Action Mode: Change this from On arrival to On overdue age.

   • Age/Duration: Set this to 20m (or 1200 seconds).

How This Works:

The nas probe will catch the Crowdstrike or Splunk "Service Down" alarms instantly but will hold them in a pending state.

• If the service comes back up within 20 minutes, a clear alarm will arrive, cancelling the action.

• If the service remains down for the full 20 minutes, the alarm hits its "overdue age," and the notification action triggers. All your other service profiles will continue to alert on their standard 10-minute thresholds.