Event Management

Event Sources

NetCrunch processes events coming from a variety of sources. Some of them may be external like SNMP Traps or Windows Event Log entries and others generated by NetCrunch like Monitoring Events (node state changed) or Atlas Events (like new node discovered). See diagram below describing event types and sources in NetCrunch.

NetCrunch Events Diagram

State Events

  • Node Up/Down/Warning
  • Wrong Node State
  • Service Up/Down/Error
  • Windows Service State Changed
  • Interface Up/Down


Monitored for Windows, Linux, NetWare, SNMP and Services performance measures. They can be based on the following conditions:

  • When counter values goes over or under threshold.
  • When counter exists or does not exist.
  • When value equal or does not equal given value.
  • When value deviates from average by specified percentage.


Specific events for services HTTP/S, SMTP, POP3, FTP, DNS.

Includes events generated upon different errors which may occur during checking above services.


  • Heartbeat - periodically confirms NetCrunch state.
  • New node discovered and added to atlas.
  • Node deleted from atlas.
  • Node added or removed from map/view.
  • Node monitoring enabled/disabled

Alerts = Events + Actions

When NetCrunch Event Manager receives an event, it is first written to the Event Database, then the program processes and executes the actions defined for the event. Actions can be defined on different levels - for each node or group of nodes (map, atlas).

Alert Escalation and Correlation

Actions assigned to an event can be performed immediately or after some time if the event has not been cleared.

Most of the built-in events are correlated and when the event condition changes they are automatically cleared.

For example, when a given event is received by NetCrunch, the desktop notification is immediately displayed. If the alert is not acknowledged or cleared within the next 15 minutes, the computer may be restarted.

Read more about Alerting