Events vs Alarms vs Problems in Site24x7

What are the differences between Events, Alarms, and Problems?

When an issue occurs in your IT infrastructure, Site24x7 records it at different levels to help you understand what failed, which monitor is affected, and whether multiple failures are related. These are represented through three features: Events, Alarms, and Problems.

Each feature serves a different purpose:
  1. Events identify the individual performance attributes that have changed state.
  2. Alarms indicate that a monitor is no longer in Up state.
  3. Problems correlate multiple alarms across dependent monitors to identify the underlying probable root cause.
Understanding how these three work together helps you investigate incidents faster while avoiding duplicate alerts.

What are Events?

An Event represents a status change of an individual monitoring attribute like Memory Utilization became critical, or response time breached threshold.
  1. Whenever a monitored attribute changes from Up to another state (such as Down, Trouble, or Critical), Site24x7 creates an event.
  2. Events help you understand which specific metric or attribute caused the issue.
A single monitor can generate multiple events simultaneously if multiple attributes fail.

What are Alarms?

An Alarm represents the overall health status of a monitor like a server monitor's status becomes Down or a website monitor's status shows Critical.
  1. When one or more monitored attributes cause the monitor to transition from UP to another state, Site24x7 generates a single alarm for that monitor.
  2. Unlike events, alarms don't list every attribute failure—they indicate that the monitor requires attention.
  3. Alarms help you understand which monitor is affected.

What are Problems?

A Problem correlates multiple events to figure out the root cause of them.
  1. When multiple alarms occur across related monitors, Site24x7 analyzes topology, monitor dependencies, and relationships to determine whether they originate from the same underlying issue.
  2. Instead of investigating every alarm separately, Site24x7 groups them into a single Problem representing the root cause.
  3. Problems help you understand the root cause affecting multiple monitors.

Example: How a single outage creates Events, Alarms, and a Problem

Imagine you're monitoring an e-commerce application. During a flash sale, customers report that payments are failing. When they click Pay Now, they receive a 504 Gateway Timeout error.

Behind the scenes, the application's architecture is:
Info
Website (End user)  →  Application server → Payment Application →MySQL Database
Here's what actually happened:
  1. The Database experienced an unexpected spike in CPU Utilization (98%) due to a sudden surge in database queries. Simultaneously, Disk I/O Wait exceeded its threshold, slowing database operations, and the connection got aborted.
  2. Because the database server was overloaded, the MySQL Database took longer to process queries. MySQL Response Time and Database Connection Time exceeded their configured thresholds.
  3. Since the application depends on the database, the Payment Application could no longer retrieve transaction details within the expected time. Database Latency and Application Response Time became critical.
  4. As the application became unresponsive, customers attempting to complete payments encountered HTTP 504 Gateway Timeout errors. The Website Response Time also exceeded its threshold.
  5. Site24x7 analyzed the dependency between the affected monitors and determined that the failures all originated from the Database. Instead of treating each alarm as a separate incident, it correlated them into a single Problem.
Events
Alarms
Problems
MySQL Response Time – Critical
MySQL Database – Critical
Probable root cause identified: Increased query count leads to congestion in CPU
Aborted connections- Critical
CPU Utilization – Critical
Disk I/O Wait – Critical
Database Connection Time – Critical
Database Latency – Critical
Payment Application – Critical
CPU Utilization – Critical
Application Response Time – Critical
Application Server - Critical
APDEX Score - Critical
Application Instance 5xxx Error - Critical
Website (UX Monitor) – Critical
HTTP 504 Gateway Timeout
Total Events: 11
Total Alarms: 4
Total Problems: 1



    • Related Articles

    • Scope of ServiceNow operations for events, incidents, and CMDB

      The tables below outline the required OAuth scopes to perform operations on key ServiceNow resources such as events, incidents, and CMDB. 1. CMDB (Standalone access) Resource Operations Required scope(s) CMDB Read, Create, Update, Delete cmdb.read, ...

    • Differences between root and non root installations for Linux agent

      The Linux agent can be installed by a root or a non root user. Feature Install as root and run as root user Install as root and run as non root Install as non root and run as non root Docker   Will include all metrics, without any configuration The ...

    • What are the major differences between Monitor Groups and Tags

      Monitor Groups   A Monitor Group helps in logically grouping resources, and provides a business perspective of the resources. It can be used for: Filtering monitors in the Home tab - Monitor Status Page. Filtering monitors in Configuration Rules and ...

    • Site24x7 Linux Agent modifications to "/etc/passwd" and "/etc/shadow" files - FIM Events

      Scenario You may see the Site24x7 Linux agent modifying files associated with the operating system. Reason The /etc/passwd and /etc/shadow files are critical operating system files that store user account information on a server. The Site24x7 Linux ...

    • Integrating Site24x7 with third-party apps

      You can integrate the following applications with Site24x7: Zoho Analytics helps to obtain a bird's-eye view of your organization's performance across departments by amalgamating data from varied sources.  By integrating Site24x7 with Zoho Analytics, ...