Alerts and Notifications - Predefined Alerts

Commvault provides a set of predefined alerts that are recommended for monitoring your CommCell environment.

Note

Predefined alerts are not created when a CommServe computer is upgraded. If predefined alerts exist in the CommServe server and the server is upgraded, the upgraded server includes the predefined alerts.

Predefined alerts send notifications as follows:

For email notifications, you must have the [Create Alert] permission on [CommCell] entity(s).
For subscription-based alerts, emails are sent to client owners who have subscribed to the alert.

Note

Subscription-based alerts are intended for client owners, such as laptop users, who manage their data through the Web Console. For information on subscribing to these alerts, see Setting Up Data Management Alerts.
For Analytics and Content Indexing alerts, emails are sent to the CommCell administrator.
For other predefined alerts, emails are sent to members of the master user group and the alerts appear in the Console Alerts window.

Managing Predefined Alerts

You can view, edit, enable, disable, or delete predefined alerts from the CommCell Console. For example, you might want to:

Edit a predefined alert to configure more notification types or add more users to receive the alert.
Disable or delete a predefined alert if some of them are not needed in your CommCell environment.

Procedure

From the CommCell Console ribbon, on the Home tab, click Alert > Configure Alert.

The Alerts dialog box displays all of the predefined alerts.
Click the predefined alert and perform one of the following actions:
- To edit the predefined alert, click Edit.
- To delete the predefined alert, click Delete.
- To enable the predefined alert, click Enable or select the check box in the Status column.
- To disable the predefined alert, click Disable or clear the check box in the Status column.

List of Predefined Alerts

The following table lists and describes each of the available predefined alerts:

Alert Name

Alert Category/Type

Description

Analytics - Low Disk Space

Operation / Event Viewer Events

This alert notifies the administrator when the index location used by the Index Server has reached 80% of the total available disk space.

Aux copy job delayed

Job Management / Auxiliary Copy

This alert notifies the user when an auxiliary copy operation is in a waiting state for four hours.

Aux copy job failed

Job Management / Auxiliary Copy

This alert notifies the user when an auxiliary copy operation meets one of the following criteria:

the operation fails to complete, fails to start or is aborted by the system
the operation runs late, or is skipped by the system or due to a holiday

Auxiliary copy fallen behind

Job Management / Auxiliary Copy

Any of the following criteria have been met for the selected storage policy copy:

To be copied data is over the quantity specified in TB. Default value is 25TB.
Jobs that are over number of specified days old and have not yet been fully copied.
More than the default value of 48 hrs is required to copy all data, based on the average throughput of previously run Auxiliary Copy jobs. It is recommended that you adjust this value with an estimated completion time so that the alert above will not be triggered.

Note

If you do not select the To be copied data is over option for the storage policy copy, you will receive an alert when the data to be copied exceeds the default threshold of 25TB. Also, a warning icon appears for the storage policy and the storage policy copy.

If an alert is received, give immediate attention to any abnormal condition. Immediate action will prevent the Auxiliary Copy falling behind the source copy, in terms of amount of data to be copied.

The alert indicates the criteria that triggered the alert, with one alert reason for each criterion above, respectively:

to be copied data exceeded
old jobs not copied
need more time to copy data

Assuming the Auxiliary copy has had no issues and is expected to run for that duration, use the throughput and application values from the Auxiliary Copy Job Summary Report to set the value for this third criterion. For example, application data size is 1000 GB and throughput is 500 GB/hr, set time to 2 hours.

Note

The example below shows how the throughput is calculated internally and can be followed to set the hours value for the third criterion:

Auxiliary Copy Job1 copied 4 TB in 2 hrs.

Auxiliary Copy Job2 copied 2 TB in 1 hour.

Average Throughput = (Total data copied by all jobs) / (Total time taken by all previous Auxiliary Copy jobs)

In the example,

Total data copied = 6 TB
Total time taken = 3 hrs

Average throughput is 6/3 = 2 TB/hr.

To copy 4 TB, the calculation is 4/2, rounding up to the next hour set the alert to 2 hrs.

If the amount of data to copy increases to 27 TB, set the alert to 14 hrs, if throughput is 2TB/hr.

If throughput increases, for example 10 TB can be copied in 1 hr, then set the alert to 3 hrs, if data to be copied is 27TB.

Fallen behind alert for Silo copy and Snap copy is not supported.

The interval between alerts for this criterion can be configured in the Media Management Configuration (Auxiliary Copy Configuration) dialog box. The default interval is 24 hours, which is set in the Interval (Hours) between Auxiliary Copy Fallen Behind alerts option.

Backup job failed

Job Management / Data Protection

This alert notifies the user when a backup job fails to complete, fails to start or is stopped by the system

Client Groups Exceeding Assigned License Limits

Custom Rules / Client Group License Usage Check

This alert notifies the administrator when a client computer group exceeds the limit on the amount of data the client computer group can back up. This alert is disabled by default. When a limit is set, this alert is automatically enabled. For information on setting limits on client computer groups, see Setting a Licensing Limit for Tenants.

Clone Expiration Alert

Custom Rules / Expiring clones

This alert notifies the user who created a database clone that the database clone will expire in the number of days specified in the alert. By default, the alert notifies the user that the database clone will expire in 3 days.

CommServe Anomaly Alert

Operation / Admin Alert

This alert is enabled by default.

This alert notifies the user when the system finds anomalies compared to the system thresholds calculated based on the historical data:

Anomaly in DDB Pruning: The number of deduplication database prunable blocks or CommServe job records that should be deleted does not drop for a considerable period of time, which indicates an unusual performance drop in for the deduplication database that reported the issue. The email alert sent for this anomaly contains a link to the DDB Pruning Performance Anomaly Report.
Anomaly in events: The frequency or occurrence of the events does not match the system threshold. The software verifies anomaly in events on an hourly basis, and sends an email alert for any anomaly. The email alert sent for this anomaly contains a link to the Anomaly Dashboard Report.
Anomaly in number of failed jobs: The number of failed jobs is more than the system threshold. The email alert sent for this anomaly contains a link to the Unusual Number of Failed Jobs Report.
Anomaly in number of pending jobs: The number of pending and waiting jobs is more than the system threshold. The email alert sent for this anomaly contains a link to the Unusual Number of Pending Jobs Report.
Anomaly in number of succeeded jobs: The number of succeeded jobs is less than the system threshold. The email alert sent for this anomaly contains a link to the Unusual Number of Succeeded Jobs Report.
Job activity anomaly: The number of created, deleted, or modified files in a backup job changes abruptly from the normal behavior or the total backed up root size increases or decreases short. The email alert sent for this anomaly contains a link to the Unusual Backup Job Activity Report.
Runtime anomaly in jobs: The runtime of the jobs is more than the system threshold. The email alert sent for this anomaly contains a link to the Anomaly Dashboard Report.

The system sends alerts about anomaly behavior when there are at least 10 backup jobs.

Note

A backup job runs for longer duration a few times for various reasons such as the backup of the deduplication database associated with the storage policy happens simultaneously, a user suspends a job for a duration, the operation window interrupts a job, or the subclient content that is being backed up increased unusually.

When you associate a client computer in the alert configuration, the alert notifies any anomalous backup jobs for the client computer. When you associate a storage policy in the alert configuration, the alert notifies any anomalous auxiliary copy jobs for the storage policy.

You can configure the following notification criteria in the alert configuration:
- Notify only if condition persists for (hrs and mins): Specify the duration for the anomaly to persist to send the alert.
- Repeat notification every (hrs and mins): Specify the duration to repeat the alert.
- Notify when the anomalous job count is more than: This option is applicable only when you select Repeat notification every criteria. Specify the anomalous job count exceeding which the alert can be sent. This condition is applicable both for the first and the repeat notifications.

Commserv anomaly digest

Custom rules / Commserv anomaly digest

This alert notifies the user about:

The client computer that may miss the SLA. The email alert contains the list of client computers, agent type of the client computer, name of the subclient, and reason for missing the SLA.
The entities that missed the SLA. The email alert contains the list of client computers, agent type of the client computer, name of the subclient, and reason for missing the SLA.
Runtime anomaly in jobs, when the runtime of the jobs is more than the system threshold.
Anomaly in events, when the frequency or occurrence of the events does not match the system threshold.

This alert is disabled by default.

Content Indexing - Document Count Alert

Operation / Event Viewer Events

This alert notifies the CommCell administrator when the number of content indexed documents has reached 20,00,000 on a search node with a limit of 30,000,000 indexed documents.

By default, this check is performed every 90 minutes. To change the frequency of this alert, edit the alert and under Threshold and Notification Criteria Selection, select Repeat Notification Every and select how often you want the alert to be sent.

Content Indexing - Low Disk Space

Operation / Event Viewer Events

This alert notifies the CommCell administrator when the size of the content index has reached 80% of the total available disk space.

Data Aging is disabled for last n days

Custom Rules / Data aging is disabled for n days

This alert notifies the CommCell administrator when data aging was disabled for the client computers or the client computer groups for a specified number of days.

This alert is disabled by default. To enable the alert, see Managing Predefined Alerts.

Data aging job failed

Job Management / Data Aging

This alert notifies the user when a data aging operation meets one of the following criteria:

the operation completes with errors
the operation fails to complete, fails to start or is aborted by the system

Data Verification Failure Detected

Custom Rules / Data Verification Failure Detected Custom Rule

This alert notifies the user when a failure is detected by the Data Verification job.

Decrease in data size

Job Management / Data Protection

This alert notifies the user when a backup job is at least 10% smaller in application size than the previous backup job of the same backup type.

Dedup DB reconstruction job failed

Job Management / DeDup DB Reconstruction

This alert notifies the user when a reconstruction job for a deduplication database meets one of the following criteria:

the operation is initiated by a user
the operation fails to complete, fails to start or is aborted by the system

This alert monitors all the storage policies in the CommCell.

Dedup Pruning Performance

Operation / Event Viewer Events

When the Dedup Pruning Performance alert is enabled,an alert email is sent when the system detects anomalies in the DDB data pruning behavior for the following two entities:

CommServe job records to be deleted
DDB prunable block scount

The anomaly includes consistent increase in the number of the two entities.

If the DDB pruning is occurring regularly, then the count for both the CommServe job records to be deleted and the DDB prunable blocks count must fall to 0 at regular time intervals. However, if the system detects that the numbers are consistently increasing and not resetting to 0, then the alert is generated.

Deduplication Database Threshold

Operation / Event Viewer Events

This alert notifies the user when the average query and insertion (QI) time for the past three days of the deduplication database exceeds 70% of the two milliseconds threshold.

When this alert occurs, make sure that the deduplication database is hosted on the recommended configuration referenced in Building Block Guide.

For more information, see KB Article DD0005.

Device went offline

Media Management / Device Status

This alert notifies the user when a drive or mount path in a library goes offline.

Dirty volumes on client

Operation / Event Viewer Events

This alert notifies the user when a Windows file system agent detects a volume with file system errors (dirty volume). Only volumes that are added to the subclient content are checked for errors.

The volume is checked every 24 hours or when a backup job runs if you selected the optimized scan method.

Disaster Recovery CommServe Alert

Operation / Event Viewer Events

This alert notifies the user when services associated with another CommServe (for example, a staged CommServe) tries to connect to the active CommServe. (When error code 19:2008 is encountered.)

Disaster recovery job failed

Job Management / Disaster Recovery Backup

This alert notifies the user when a disaster recovery backup operation completes with errors or warnings.

Disk space low on MediaAgent

Configuration / MediaAgents

This alert notifies the user when the disk space for the MediaAgent software installation and system directories (including the Index Directory folder) reaches the minimum thresholds. This alert monitors all the MediaAgent clients in the CommCell.

The threshold for the MediaAgent software installation and system directories can be configured by using additional settings.

The threshold for the Index Directory can be configured from the CommCell Console (MediaAgent > Properties > Catalog). See Index Retention Parameters.

Edge drive/share operations alert

Configuration / Edge drive/Share operations

This is a subscription-based alert, which notifies the end user when any share which a user is involved with undergoes a change. For example, renaming a share, adding comments to a share or changes made to the size of a share will send an email alert to the client owner who has subscribed to the alert.

A CommCell Administrator can select which laptop clients or laptop client groups need to receive this subscription-based alert from the Entities Selection page in the Alert Wizard. Client owners can unsubscribe from this alert from the Web Console.

Edge drive quota alert

Configuration / Users

This is a subscription-based alert, which notifies the end users when the quota assigned to them meets one of the following criteria:

Properties Modified
Quota Exceeded
Quota exceeding threshold
Quota validation failed

A CommCell Administrator can select which laptop clients or laptop client groups need to receive this subscription-based alert from the Entities Selection page in the Alert Wizard. Client owners can unsubscribe from this alert from the Web Console.

Increase in data size

Job Management / Data Protection

This alert notifies the user when a backup job is at least 10% larger in application size than the previous backup job of the same backup type.

Index State

Custom Rules / Index State

This alert notifies the user when errors occur during index backup operations.

Insufficient storage on library

Media Management / Library Management

This alert notifies the user when there is no spare media in a library, or if the number of spare media for the scratch/cleaning pool in a library falls below the watermark.

For disk libraries, the alert is sent if the disk space falls below the watermark or if there is insufficient disk space.

Library maintenance required

Media Management / Library Management

This alert notifies the user when a library meets one of the following criteria:

a library or drive exceeds its threshold
a drive requires cleaning
a mount path exceeds its fragmentation threshold

License consumed exceeds 80%

Configuration / License

This alert notifies the user when the consumption of CommCell licenses have reached 80%.

License expires within 7 days

Configuration / License

This alert notifies the user 7 days prior the CommServe license expiration.

Low disk space on client

Configuration / Clients

This alert notifies the user when the disk space for the client software installation and system directories (including the Job Results folder) reaches the minimum thresholds. For more information, see Configuring Alerts for Low Disk Space.

You can configure the threshold for the client software installation and system directories using additional settings.

You can configure the threshold for the Job Results directory on the CommCell Console in the Client Computers properties dialog box. For more information, see Setting the Minimum Free Space for the Job Results Directory.

This alert monitors all the client computers in the CommCell.

Metallic backup gateway are offline

Custom Rules/Metallic Backup Gateways are Offline Custom Rule

This alert will send email notifications about backup gateway node that are offline.

Note

The MediaAgent that are disabled and marked for maintenance will not receive notifications.

Media mount and usage error

Media Management / Library Management

This alert notifies the user when a library meets one of the following criteria:

a media is marked read-only, bad or deprecated
a mount or unmount error has occurred

No Backup for last 4 days

Job Management / Data Protection

This is a subscription-based alert that notifies client owners when a backup operation for a laptop client does not occur in the last 4 days. A CommCell Administrator can select the laptop clients or laptop client groups that require this subscription-based alert from the Entities Selection page in the Alert Wizard. Client owners can unsubscribe from this alert from the Web Console.

This alert is not applicable to synthetic full backup jobs.

No backup for last 7 days

Job Management / Data Protection

This alert notifies users when backup operations do not occur for a client computer and the associated virtual machines (that are part of subclient content) in the last 7 days.

Note

No backup alert condition is calculated based on the start time of the last successful backup job.

This alert is not applicable to:

VMs that have Commvault software installed.

Synthetic full backup jobs

By default, subclients that have backup activity disabled are excluded from this alert. To send the alert for subclients that have backup activity disabled, you can add the Check Disabled Subclients for No backup additional setting with a value of 0 to the CommServe computer as shown in the following table.

For instructions on adding the additional setting from the CommCell Console, see Adding or Modifying Additional Settings from the CommCell Console.

Property	Value
Name	Check Disabled Subclients for No backup alert
Category	CommServDB.GxGlobalParam
Type	Integer
Value	0 - the alert is sent for all subclients that are not backed up recently, including the subclients with backup activity disabled.

No Index Backup in last 30 days

Custom Rules / Index Backup Status

This alert notifies the user when indexes are not backed up within 30 days. The IndexBackup subclient on the MediaAgent is monitored.

No recent DDB backup

Operation / Event Viewer Events

This alert notifies the user when there are no recent deduplication backup jobs occurring in the CommCell.

Non-Dedup Pruning Backlogged

Operation / Event Viewer Events

When the Non-Dedup Pruning Backlogged alert is enabled, an email alert is generated on crossing the threshold configured for the following configuration parameters.

Max number of records pending pruning for non dedup pruning per mount path threshold event
Days to consider for pending logical pruning for Deduplication Pruning threshold event

For example: If the value for Days to consider for pending logical pruning for Deduplication Pruning threshold event is set at 7 days. The value for Max number of records pending pruning for non dedup pruning per mount path threshold event is set for 5000. Then an alert is generated if there are 5000 or more records pending for pruning on a mouth path for 7 or more days.

Threat Indicator Alert

Operation / Event Viewer Events

This alert notifies the user when a possible ransomware attack is detected. The alert is triggered by event codes 7:211, 7:212, 7:269, 7:293, 7:333, 14:336, 14:337, and 69:59 that are added as regular expression.

Restore Job failed

Job Management / Data Recovery

This is a subscription-based alert, which notifies client owners when a restore fails for a laptop client.

Security Alert

Administrative Shares Configured

This alert notifies the administrator that there are administrative shares used to configure a disk library mount path and/or disaster recovery (DR) backups export location. Reconfigure the administrative shares using a dedicated share to turn-off the alert. For more information, see Removing Administrative Shares from Windows Servers.

Subclient Association Limits for Deduplication

Operation / Event Viewer Events

This alert notifies the user when the average query and insertion (QI) time of the deduplication database exceeds 70% of the two milliseconds QI threshold. This alert is to notify users that the storage policy will not accept new subclients when the average QI time of the DDB exceeds 80% of the two milliseconds threshold. To avoid blocking the storage policy for subclient association, see KB Article DD0006.

Tape OML Mismatch Alert

Operation / Event Viewer Events

This alert is generated during media mount and unmount if there is a mismatch in the media between the OML (On Media Label) and the bar code.

Unusual Job Activity

Operation / Event Viewer Events

This alert is generated when the system detects anomalies in that day's regular backup or synthetic backup jobs in relation to other recent backup jobs. Such deviations include sudden increases or decreases in the number of created, modified, or deleted files and folders.

This features applies to Indexing Version 2 only.

Before the Unusual Job Activity check runs, the system requires at least 100 observations for regular backup jobs and 100 observations for synthetic backup jobs. These observations provide the baseline data that the Unusual Job Activity check uses to determine whether anomalies occur.

The Unusual Job Activity feature is always enabled. However, the CommCell Console alert, and its corresponding summary email message, can be turned on or off.

Updates available for download

Software Updates / Updates Available to Download

This alert notifies the user when one or more Commvault updates are available for download.

Virtual Machine has been decommissioned

Custom Rules / Notify decommissioned Virtual Machines

This alert notifies the user when a virtual machine is decommissioned and identifies the timeline for completing backup copy operations before the VM client is deleted.

Web Endpoint Offline

Operation / Event Viewer Events

This alert notifies the user when services stop on any of the following platforms in the CommCell environment:

Analytics Engine
Search Engine
Web Console
Web Server

Services are checked every five minutes. If a service stops, users receive a notification. Repeat notifications are sent every hour until services are running again. This alert is disabled by default.

From the CommCell Console, you can modify how often repeat notifications are sent after a service stops.

On the CommServe computer, add the additional settings as shown in the following table.

For instructions about adding the additional settings from the CommCell Console, see Adding or Modifying Additional Settings from the CommCell Console.

Alert	Additional Setting	Category	Type	Value
Analytics Engine	nAnalyticsAlertThreshold	Base	Integer	The number of seconds between notifications. For example, to configure a notification every five minutes, enter 300.
Search Engine	nSearchEngineAlertThreshold
Web Console	nWebConsoleAlertThreshold
Web Server	nWebServerAlertThreshold

Web Endpoint Online

Operation / Event Viewer Events

This alert notifies the user when services start on any of the following platforms in the CommCell environment:

Analytics Engine
Search Engine
Web Console
Web Server

This alert is disabled by default.