Problems

An alert is a signal. A problem is a condition. monsys shows problems: a disk that stays full for a day is one line, not a hundred alerts. The alerts remain available as events under the problem.

What a problem is

A problem is recognised by three things: the system, the kind and the subject (for example the disk /). The reading is not part of it. If the disk goes from 91 to 96 percent, it is the same problem with a higher severity and a new peak.

State	Meaning
Open	Nobody has picked it up
Acknowledged	Someone has seen it and is working on it
Accepted	Left as it is on purpose, with a reason and an end date
Resolved	Closed by itself: measured, or reported by the source
Closed	Closed by a person

When it closes by itself

Kind	Rule
Disk	Under 85 percent for 10 minutes
CPU	Under 80 percent for 10 minutes
Memory	Under 90 percent for 10 minutes
Service, container, uptime, certificate	As soon as the source reports it is over
Other	When it stops happening while the system keeps reporting

No fresh reading means no verdict. A server that goes silent closes no problems.

The history shows what happened: when it started, the peak, how long it lasted and that it recovered by itself.

Recurring

If the same problem returns three times within 24 hours, it becomes recurring. It does not ring every time and it stays on the list for at least 24 hours after the last occurrence. That shows you there is a cause underneath that persists.

Notifications on your phone

• One notification when the problem opens.
• One notification when it gets worse.
• A quiet notification when it recovers by itself.
• A critical problem that nobody acknowledges is repeated after 30 minutes, 2 hours and 8 hours. The third time it also goes to the on-call channel.

Critical always reaches the phone. Warnings reach the phone when they concern availability: disk, memory, silent host, stopped service or container, uptime, certificate, backup. Everything else is on the list.

Accepting

Accepting is a choice with a reason and an end date (90 days at most). The problem leaves the “To do” list and returns on the end date, or sooner if it gets worse.

Activity is not a problem

An applied patch, an exec in a container or an updated agent are events. They are in the timeline and ask for no attention.

API

GET  /api/v1/problems?state=active|accepted|resolved|all
GET  /api/v1/problems/{id}
POST /api/v1/problems/{id}/acknowledge
POST /api/v1/problems/{id}/accept     {"reason": "...", "days": 30}
POST /api/v1/problems/{id}/close      {"notes": "..."}
POST /api/v1/problems/{id}/reopen
POST /api/v1/problems/{id}/assign     {"user_id": "me"}
POST /api/v1/problems/{id}/snooze     {"hours": 4}

Every action is written to the audit log.