File IQ Alerts

Introduction

The Nasuni File IQ Alerting feature offers proactive visibility into volume usage, performance, and structural changes. Administrators can configure alerts to receive timely notifications of unusual activity or potential issues, providing proactive insights into your Edge Appliances and volumes.

Email alerts are available for both volume processing and activity events.

Note: A Nasuni File IQ Premium license is required to enable the Nasuni File IQ Alerting feature.

Activity Alerts

Activity Alerts monitor file and user activity, highlighting anomalies or significant changes so teams can respond quickly. By default, Grafana evaluates activity alerts every 5 minutes, with customizable intervals available through the alert configuration page.

The supported alerts include the following:

• Activity – Edge Appliance Throughput Alert

• Activity – Volume Delete Events Alert

• Activity – Volume Write Events Alert

Volume Alerts

Volume Alerts provide scheduled insights into storage usage, including file count and total volume size. By default, these alerts are generated weekly, but the frequency can be customized through the alert configuration page. Volume Alerts help teams track storage utilization, identify usage, and trends.

The supported alerts available include the following:

• Volume Processing - Volume File Count Increase Alert

• Volume Processing - Volume Size Increase Alert

Overview

This section provides an overview of the File IQ Alert concepts and logic.

Rules

Alert rules define the specific conditions that trigger an alert notification. When activity or usage exceeds a predefined threshold, such as a spike in write events or an increase in file count, an automated email alert is sent. These rules can be easily configured within the Nasuni File IQ interface and include the following elements:

• Name: A unique identifier for the alert rule.

• Condition: The criteria that determine when the alert is triggered, such as "Number of Write events > 80%".

• Interval: How often the alert condition is evaluated (See the Time Intervals section below for details).

Instances

Alert instances refer to the specific occurrences that trigger an alert rule. They are created when the conditions of the alert rule are met. The key details of an alert instance include the following:

• Alert Name: The name of the alert rule that triggered the instance.  

• Status: The current state of the alert instance, which can be:

  • Firing: The alert condition is currently true.

  • Resolved: The alert’s rule condition is no longer true.

• Start Time: The timestamp indicating when the alert condition was first met.

• End Time: The timestamp indicating when the alert condition was resolved (if applicable).

Time Intervals

File IQ Alerting uses three types of time intervals to manage how and when alerts are evaluated and sent:

Evaluation Interval: This refers to the frequency at which the system checks whether an alert condition has been met. File IQ checks alert conditions periodically according to this interval.

Alert Interval: This defines the timeframe used to evaluate the data. For example, a 10-minute window means the system looks at the most recent 10 minutes of activity to determine if the alert condition is met.

Repeat-After Interval: This sets how long the system waits before sending the same alert again. Even if the condition still exists, no new alert will be sent until this time period has passed, helping prevent duplicate notifications.

The example below demonstrates the following:

• Evaluation Interval: 5 minutes

• Alert Interval: 10 minutes

• Repeat After Interval: 4 hours

The following table details the value for these three intervals for Activity and Volume alerts:

Adjusting Email Notification Frequency

You can control how often you receive email notifications for alerts by modifying the Repeat After Interval setting.

This setting defines the minimum time (in minutes) between repeated notifications for a single alert. It helps reduce noise by instructing the system, “Only send another alert if this condition is still true after a set amount of time has passed”.

Note: The Evaluation Interval occurs every 5 minutes. If the Repeat After Interval matches or is a multiple of the Evaluation Interval, notification timing might align with the next scheduled evaluation. As a result, alerts might not always be sent exactly after the specified interval.

Tips for Managing Notification Frequency

• To receive more frequent reminders: Decrease the Repeat After Interval to get more frequent notifications when an alert remains active (firing) over time.

• To reduce the number of emails: Increase the Repeat After Interval to limit the number of reminder notifications for ongoing (firing) alerts.

Adjusting this setting allows you to strike the right balance between staying informed and minimizing email noise.

Configuration

To use the File IQ Alerting feature, you must have a Nasuni File IQ appliance managed through the Nasuni Management Console (NMC) version 25.2 or above, and an active Nasuni File IQ Premium license.

Once these prerequisites are met, complete the following steps to enable alerting:

• Configure a group of email recipients

• Enable the alerting feature

• Send test email

• Configure and enable individual alerts

Note: All Nasuni File IQ alert rules are disabled by default.

Configuring Email Recipients

The alert email recipient list is created in the Nasuni Management Console. This section describes the process of creating a dedicated group for alert emails, or alternatively, enabling an existing group to be notified.

Creating a Dedicated Group for Nasuni File IQ Alerts

To configure a dedicated alert email group for Nasuni File IQ alerts, follow these steps:

1. Navigate the NMC UI.

2. Click the Console Settings tab.

3. From the left side menu, click the Users/Groups option.
    

4. Click Manage Groups.

5. Click Add Group.

6. Enter a Group Name.

7. For Access Type, select User Interface Access.

8. In the Filer Permissions section, ensure that Receive Filer alert emails is selected.

9. In the Email Subscriptions section, select Nasuni File IQ Alerts.
   

10. (Optional) To configure alerts for users who are not in the system, add their email addresses to the Extra Emails field.

11. In the Filer Access section, grant access to the Nasuni File IQ Appliance.

12. Click Add Group to finish.

Enabling Alerts for an Existing Group

To enable alert emails for an existing group, follow these steps:

1. Navigate the NMC UI.

2. Click the Console Settings tab.

3. From the left side menu, click the Users/Groups option.

4. Click Manage Groups.

5. For every group receiving File IQ Report Ready alerts, click the edit icon.
    

6. In the Filer Permissions section, ensure that Receive Filer alert emails is selected.

   Note: If Manage all aspects of the Filer is selected, Nasuni File IQ Alerts is implicitly selected.

7. In the Email Subscriptions section, select Nasuni File IQ Alerts.
    

8. (Optional) To configure alerts for users who are not in the system, add their email addresses to the Extra Emails field.

   Note: Individuals added to this field receive alerts for all configured alert types. If this is not desirable, consider creating a dedicated group for reporting alerts.

9. Click Save Group.

Enabling the File IQ Alerting Feature

To enable the File IQ Alerting feature, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Check the Enable Alerts box.
   

4. Click Save.

   Note: If you disable the Alerts feature, all alerts are disabled; however, any settings you have provided are preserved for when you re-enable the Alerts feature again.

5. (Optional) Configure additional email recipients.

   1. Click Send Test Email to confirm that the File IQ Alerts feature and recipients are correctly configured.

6. Navigate to the following sections to configure and enable the File IQ alerts you want to set up:

   - Activity – Edge Appliance Throughput Alert

   - Activity – Volume Delete Events Alert

   - Activity – Volume Write Events Alert

   - Volume Processing - Volume File Count Increase Alert

   - Volume Processing - Volume Size Increase Alert

Sending a Test Email

After setting up the email recipient group and enabling the alerting feature, you can send a test email to verify that the configuration is working correctly.

To send a test email:

1. Open the File IQ user interface.

2. Go to the Configuration tab and select Alerts Configuration.

3. Click the Send Test Email button.

An email request will be sent to the NMC, and a confirmation message will appear in the top-right corner of the File IQ user interface:

The test email typically arrives within one minute. If you do not receive the email, check the following:

• Your spam or junk folder

• That the email notification group is correctly configured as described above

• (Optional) That your email address is added to the Extra Emails field if your user is not listed in the system

• That the NMC email configuration is correctly set up

You can find more information on configuring SMTP settings in the Email Settings section of the Nasuni Management Console documentation.

Also, verify that there are no error notifications in the NMC related to email delivery.

If the issue persists, contact your IT support team for further assistance.

Available Alerts

Nasuni File IQ Alerts are divided into two primary categories: activity alerts and volume processing alerts. This section details each available alert, its purpose, parameters, and configuration.

Activity – Edge Appliance Throughput Alert

The File IQ Edge Appliance Throughput Alert detects when a significant number of file system audit events occur over a specified period across all Edge Appliances configured to forward their audit events to the Nasuni File IQ Appliance.

Configuration

To configure the Edge Appliance Throughput Alert, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Under the Nasuni File IQ Alerts section, locate the Edge Appliance Throughput Alert and click the corresponding Edit button.
   

4. Check the Enable Alert box.
   

5. Use the provided fields to enter an Interval, Threshold, Repeat After, and optional Footer Alert Text. The following table provides additional parameter information.

6. Click Save.

Email Notification

An email is sent as soon as the alert firing status changes, and then according to Repeat After Interval as long as it remains active.

These alerts include the following information:

• Alert Name: The alert name and the number of instances with status changes are provided in the email subject.

• Alert notification details: Provided as part of the email body:

  • Nasuni File IQ Appliance name exceeding the event threshold

  • Number of events

  • Alert status

  • When the alert fired (UTC)

  • Alert resolution (UTC)

    Note: If unresolved, this field is empty.

• Alert Description: A brief description of the alert

• Configuration Summary: Key parameters used in the alert configuration include:

  • Interval: Alert Interval used for the alert detection

  • Threshold: Number of events observed before the alert fires

  • Repeat After: Resends an alert notification if not resolved within the selected time interval

• Dashboard Link: A link to the Nasuni File IQ Inspector dashboard

Activity – Volume Delete Events Alert

The File IQ Volume Delete Events Alert monitors each volume for high levels of file deletions within a defined time period. It helps identify high delete activity so you can take action quickly.

Configuration

To configure the Volume Delete Events Alert, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Under the Nasuni File IQ Alerts section, locate the Volume Delete Events Alert and click the corresponding Edit button.

4. Check the Enable Alert box.
   

5. Use the provided fields to enter an Interval, Threshold, Repeat After, and optional Footer Alert Text. The following table provides additional parameter information.

6. Click Save.

Email Notification

An email is sent as soon as the alert firing status changes, and then according to Repeat After Interval as long as it remains active.

These alerts include the following information:

• Alert Name: The alert name and the number of instances with status changes are provided in the email subject.

• Alert notification details: Provided as part of the email body:

  • Nasuni volume names exceeding the event threshold

  • Number of events

  • Alert status.

  • When the alert fired (UTC)

  • When the alert resolved (UTC)

    Note: If unresolved, this field is empty.

• Alert Description: A brief description of the alert

• Configuration Summary: Key parameters used in the alert configuration

  • Interval: Interval used for alert detection

  • Threshold: Number of delete events observed before the alert fires.

  • Repeat After: Resends an alert notification if not resolved within the selected time interval

• Dashboard Link: A link to the Nasuni File IQ Inspector dashboard

Activity – Volume Write Events Alert

The Volume Write Events Alert tracks each volume for high write activity over a set time period. It allows you to investigate and respond as needed.

Configuration

To configure the Volume Write Events Alert, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Under the Nasuni File IQ Alerts section, locate the Volume Write Events Alert and click the corresponding Edit button.

4. Check the Enable Alert box.
   

5. Use the provided fields to enter an Interval, Threshold, Minimum Volume Size, Minimum of Write Events, Repeat After, and optional Footer Alert Text. The following table provides additional parameter information.

6. Click Save.

Email Notification

An email is sent as soon as the alert firing status changes, and then according to Repeat After Interval, as long as it remains active.

These alerts include the following information:

• Alert Name: The alert name and the number of instances with status changes are provided in the email subject.

• Alert notification details: Provided as part of the email body:

  • Nasuni volume names that exceed the event threshold

  • Percentage difference.

  • Alert status.

  • When the alert fired (UTC)

  • When the alert resolved (UTC)

  • Note: If unresolved, this field is empty.

• Alert Description: A brief description of the alert

• Configuration Summary: Key parameters used in the alert configuration

  • Interval: Interval used for alert detection

  • Threshold: Percentage increase of write events observed before the alert fires

  • Minimum Volume Size: Applies the alert to volumes with the specified minimum size

  • Minimum Number of write events: Applies the alert to volumes with the minimum number of write events for the selected interval

  • Repeat After: Resends an alert notification if not resolved within this selected time interval

• Dashboard Link: A link to the Nasuni File IQ Inspector dashboard

Volume Processing - Volume File Count Increase Alert

The Volume File Count Increase Alert notifies you when the number of files on a volume grows beyond a set threshold within a defined time period. It helps you quickly identify high file growth that may impact storage performance or capacity.

Configuration

To configure the Volume File Count Increase Alert, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Under the Nasuni File IQ Alerts section, locate the Volume File Count Increase Alert and click the corresponding Edit button.

4. Check the Enable Alert box.

5. Use the provided fields to enter an Interval, Threshold, Minimum Volume Size, Minimum File Count, Repeat After, and optional Footer Alert Text. The following table provides additional parameter information.

6. Click Save.

Email Notification

An email is sent as soon as the alert firing status changes, and then according to Repeat After Interval as long as it remains active.

These alerts include the following information:

• Alert Name: The alert name and the number of instances with status changes are provided in the email subject.

• Alert notification details: Provided as part of the email body:

  • Nasuni volume names exceeding the event threshold

  • Number of files

  • Alert status.

  • When the alert fired (UTC)

  • When the alert was resolved (UTC)

    Note: If unresolved, this field is empty.

• Alert Description: A brief description of the alert

• Configuration Summary: Key parameters used in the alert configuration

  • Interval: Interval used for alert detection

  • Threshold: Number of files added before the alert fires

  • Minimum Volume Size: Applies the alert to volumes with the specified size

  • Minimum File Count: Applies the alert to volumes with the specified minimum file count

  • Repeat After: Resends an alert notification if not resolved within the selected time interval

• Dashboard Link: A link to the Nasuni File IQ Volume Explorer dashboard

Volume Processing - Volume Size Increase Alert

The Volume Size Increase Alert notifies you when the total size of a volume grows beyond a specified threshold within a set time frame. It helps you monitor storage usage and detect high data growth early.

Configuration

To configure the Volume Size Increase Alert, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Under the Nasuni File IQ Alerts section, locate the Volume Size increase Alert and click the corresponding Edit button.

4. Check the Enable Alert box.
   

5. Use the provided fields to enter an Interval, Threshold, Minimum Volume Size, Minimum File Count, Repeat After, and optional Footer Alert Text. The following table provides additional parameter information.

6. Click Save.

Email Notification

An email is sent as soon as the alert firing status changes, and then according to Repeat After Interval as long as it remains active.

These alerts include the following information:

• Alert Name: The name of the alert and the number of instances with status changes are provided as the email subject.

• Alert notification details: Provided as part of the email body:

  • Nasuni volume names that exceed the event threshold.

  • Percentage difference.

  • Alert status.

  • When the alert fired (UTC)

  • When the alert resolved (UTC)

  • Note: If unresolved, this field is empty.

• Alert Description: A brief description of the alert.

• Configuration Summary: Key parameters used in the alert configuration:

  • Interval: Interval used for alert detection

  • Threshold: Percentage increase in volume size before the alert fires

  • Minimum Volume Size: Applies the alert to volumes with the specified minimum size

  • Minimum File Count: Applies the alert to volumes with the specified minimum file count

  • Repeat After: Resends an alert notification if not resolved within the selected time interval

• Dashboard Link: A link to the Nasuni File IQ Volume Explorer dashboard

Annexe - Configuring the Alert Notification Footer

You can customize the footer that appears at the bottom of the File IQ alert emails. Footer customization is available in two ways:

• Per alert rule

• Globally (for all alert rules)

When using both types of footers, the email displays the per-alert footer first, followed by the global footer.

Configuring the Alert Footer for All Alerts

To customize the footer for all alerts, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.
   

3. Use the Alert Footer box to enter your footer text.

4. Click Save.

Configuring the Alert Footer for Individual Alerts

To customize the footer for an individual alert, follow these steps:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Scroll down to the Nasuni File IQ Alerts section.

4. Find the alert for which you want to configure a custom footer and click the corresponding Edit.
   

5. Use the Alert Footer Text box to enter your footer text.

6. Click Save.

Annexe - Resetting Alerts to the Default Configuration

Resetting an alert restores it to its original default settings. This action disables the alert and removes any custom configurations you’ve applied.

To reset an individual alert:

1. Navigate to the File IQ UI.

2. Click the Configuration tab and select Alerts Configuration.

3. Scroll down to the Nasuni File IQ Alerts section.

4. Find the alert for which you want to reset and click the corresponding Reset.

To reset all alerts at once, click Reset All Alerts Configuration.