Skip to main content

Manage maintenance windows

Maintenance windows let you schedule periods of time when alerts with selected values are identified as "in maintenance." For more information on the maintenance fields, see Use maintenance window fields

For general information on the Maintenance Windows feature, see Maintenance Windows overview. For instructions on excluding alerts created during maintenance windows from forming incidents, see Use maintenance windows to reduce noise.

Schedule a maintenance window

To schedule a maintenance window:

  1. Navigate to Correlate & Automate > Maintenance Windows.

  2. Click Add Maintenance Window.

  3. At the top of the page, add a name (required) and a description (optional) in the corresponding fields to identify the maintenance window.

  4. Under What is affected, define the filter to match the events you want to identify as "in maintenance" during the window.

    The filter is configured using event data fields and their values. This configuration determines whether or not an alert meets criteria during the window.

    Example 1. Maintenance window filters

    You can create any type of filter you choose using any data field. Some commonly used fields include severity, source, service, the contents of a custom tag, or a combination of multiple statements by adding the AND operator.

    • source = "10.11.67.54" AND service in [ "outlook365", "email"]

    • service = myService AND severity in ( Major , Critical )



  5. Under When does the window take effect, select a start and stop time for the window.

    Note

    All maintenance windows times are in the same time zone as the user configuring them. Select Use alternate time zone if you need to configure a maintenance window in a time zone other than your own.

    You can select the following options for maintenance windows:

    • Begin and end the window at configured times

    • Last an entire day

    • Repeat, or do not repeat

    • Start immediately and continue for a set amount of time

  6. Under Link to change record (Optional), you can add a URL for a change record in an external system.

  7. Click Save in the upper-right area of the page.

Tip

While maintenance windows are generally used to identify alerts that could have been caused or affected by planned maintenance activities, you can also use a maintenance window to identify alerts received during a known issue.

Certain types of network problems can cause floods of alerts which you may not want to correlate into new incidents if a team is already addressing the underlying issue. Use the Start now option to create the window. Then, use the maintenance alert fields with a correlation definition to avoid creating incidents from them. Alternatively, you can use the fields to identify alerts relating to the issue while allowing correlation to proceed as usual.

Copy an existing maintenance window

If you need to create a new maintenance window that is similar to an old one, you can save time by copying the previous configuration.

  1. Navigate to Correlate & AutomateMaintenance Windows.

  2. Locate the row of the window you want to copy, and click the Copy icon:

    CopyMaintenanceWindow.png

  3. Many any necessary configuration changes (changing the name is recommended).

  4. Click Save.

End an active maintenance window

When a window is active, you have the option to end the window immediately. Note that you cannot edit an active window.

  1. Navigate to Correlate & Automate > Maintenance Windows.

  2. Click the row for the active window.

  3. Under the Status section of the Summary tab, Click End Now.

    The maintenance window immediately ends and is added to the Expired list.

Edit a maintenance window

To edit a scheduled maintenance window:

  1. Navigate to Correlate & Automate > Maintenance Windows.

  2. Click the Scheduled tab and then click the row of the window you want to edit.

    NOTE: You can only edit scheduled maintenance windows, not active or expired windows.

  3. Click Edit in the top-right area of the page.

  4. Click the Configuration tab.

  5. Make any changes.

  6. Click Save in the top-right area of the page.

Skip a maintenance window occurrence

To skip the next occurrence of a scheduled maintenance window:

  1. Navigate to Correlate & Automate > Maintenance Windows.

  2. Click the Scheduled tab and then click the row of the window you want to edit.

    NOTE: You can only edit scheduled maintenance windows, not active or expired windows.

  3. Click Skip.

    Skipping bypasses the next scheduled occurrence; other future occurrences are unaffected.

Delete a maintenance window

To delete a scheduled maintenance window:

  1. Navigate to Correlate & Automate, > Maintenance Windows.

  2. Click the row of the window you want to delete.

    NOTE: You can only delete scheduled maintenance windows, not active or expired windows (though you can end an active window).

  3. Click Delete (trashcan icon) in the upper-right area of the page.

  4. Confirm the deletion.

    The scheduled maintenance window is removed.

In this section: