Once an alert has been classified by an Alert Rule, it is assigned a Resend Interval, and dispatched to an Escalation Chain.  The Escalation Chain defines who is contacted about this alert, and in what order.

Escalation chains are defined in the Settings Tab, by clicking Escalation Chains in the left panel.

An Escalation Chain consists of a name, destination stages, and a CC field. You can create a new Escalation Chain by clicking the Add button in the top right of the Escalation Chains page. You can edit or delete an existing chain by use of the Pencil and Delete icons, respectively.

 

There are two types of Escalation Chains:

• A Normal Escalation Chain consists of one or more stages that consists of none, one or multiple recipients. Whenever an alert needs to be dispatched, LogicMonitor will send the alert to all the recipients in the current stage. After the resend interval, it will use the next stage.
• A Time-based Escalation Chain consists of multiple subchains. Each subchain has time information indicating when it should be used to dispatch alerts through its stages.

Adding/Editing Normal Escalation Chains

The name is used to uniquely identify an escalating chain.

The rate limit mechanism is used to limit the maximum number of alerts sent to an Escalation Chain during a period.

Chains consist of multiple stages. When an alert is dispatched to an escalation chain, it will be sent to all recipients in stage 1. If the alert condition still exists and has not been acknowledged before the Resend Interval expires, then LogicMonitor will alert all recipients in stage 2. This continues until the final stage. The alert is resent to the final stage, with a frequency of the Resend interval defined for the alert, until the alert is acknowledged or the alert condition no longer exists. (An alert resend interval of zero means the alert is never escalated past stage 1, and is never resent.)

You can re-order the stages within a chain by simply dragging/dropping the stages within the Edit Chain form. You can Add/Edit/Delete stages using the buttons.

A stage consists of one or more recipients. Recipients can be:

• a LogicMonitor account username postfixed with ".pager" such as "jsmith.pager" that tells the LogicMonitor server to send the notification to the pager address of the account. The pager message will be formatted as full text or SMS format, depending on the account's settings.
• a LogicMonitor username postfixed with ".email" such as "jsmith.email" that tells the LogicMonitor server to send the notification to the email address of the account.
• a destination macro
• an email address such as 'foobar@logicmonitor.net'.
• an email address prefixed with 'sms:' such as 'sms:5551234567@tmobile.com' which tells the LogicMonitor server to generate the notification content by using the SMS template.

When you click a button to add or edit a stage, a form will display that allows you to easily create stages from all LogicMonitor accounts and destination macros.

CC Field

The CC Field supports multiple recipients using the same syntax as the stage recipients.  All notifications sent to every stage in a chain are always sent to the recipients listed in CC.  The destinations in the CC field are also always notified when a new SDT is created that affects alerts that would be routed to this escalation chain.

Adding/Editing Time-based Escalation Chains

Time-based Escalation Chains are identical to the Normal Escalation Chains, except they add the concept of Subchains.

Subchains consists of an effective time frame and multiple stages of recipients. LogicMonitor uses the effective time frame to choose the active subchain whenever an alert is through the chain. Subchains are processed in order, and the alert is routed to the first subchain that matches. Once the subchain is chosen, alerts escalate through the subchain the same as for normal chains.

For example, the dialog above shows the chain consists of two subchains. The first subchain is effective from 00:00 to 06:00 every day. The second subchain is effective at all times - but as the first subchain is higher in the list, it is processed first. Any alerts from 0:00 to 06:00 are sent to the first subchain, and alerts at all other times fall through to the second subchain.all day from Monday to Friday.

Alerts received by a chain for times for which there are no effective subchains will not be escalated. Thus in the above example, if the second subchain was not effective on weekends, alerts sent at 2:00 am Sunday through this chain would not be delivered anywhere.

You can add a subchain by clicking the "Add" button in the right of the label "Subchains" or edit/delete an existing subchain by use of Pencil and Delete icons, respectively.