Alarms
Table of Contents
- Overview
- Screen Layout — Four Submenus
- Alarm Screen (
/alarm/index) - Alarm Advanced Search Screen (
/alarm/advsearch/index) - Alarm Visual Analysis Screen (
/alarm/analysis/index) - Advanced EQL Alarm Screen (
/alarm/config/index) - Usage Scenarios
- Frequently Asked Questions
- Related Screens
Overview
The Alarm group brings together real-time monitoring of raised alarms, history search, visual analysis, and rule registration.
| Submenu | Internal URL | Purpose |
|---|---|---|
| Alarms | /alarm/index | Real-time alarm monitoring + list of the most recent 1,000 entries + statistics/rankings |
| Alarm Advanced Search | /alarm/advsearch/index | Detailed search by period, tag, asset, and priority |
| Alarm Visual Analysis | /alarm/analysis/index | Visual analysis with heatmaps, treemaps, EventDrops, and more |
| Advanced EQL Alarms | /alarm/config/index | Registration and deployment of user-defined EQL alarm rules |
A red badge next to the alarm bell icon in the top header shows the count of unacknowledged alarms; clicking it opens the Alarm screen.
Screen Layout — Four Submenus
| Screen | Primary User | Summary |
|---|---|---|
| Alarms | Operator | Real-time alarms + statistics + rankings (main monitoring view) |
| Alarm Advanced Search | Operator/Analyst | Precise search using the asset tree and multiple filters |
| Alarm Visual Analysis | Analyst | 8 visualization charts (heatmap, matrix, treemap, time series, priority, etc.) |
| Advanced EQL Alarms | ADMIN | Rule definition, deployment, undeployment, redeployment |
Use the dropdown (▼) in the page header to jump quickly between the four screens.
Alarm Screen (/alarm/index)
Top Search Area
🔔 알람 [N건] [기간] [사이트 ▼] [검색] [고급 검색] [↻]
| Control | Width | Description |
|---|---|---|
Total alarm count (alarm_total_count_label) | — | Shown next to the page title |
| Submenu dropdown | — | Quick navigation to Alarms / Alarm Advanced Search / Alarm Visual Analysis / Advanced EQL Alarms |
Period (alarm_time) | 280px | Start–end (centered, bold) |
Site (site_id) | 150px | All sites + site name [description] |
| Search | Red + 🔍 | search() |
| Advanced search shortcut | Red + 🔍+ | Opens the Alarm Advanced Search screen (goAdvancedSearch()) |
| Refresh | Red + ↻ | Refreshes the screen |
Timeline
| Item | Description |
|---|---|
| Header | 🕐 "Timeline" + display range label (alarm_timeline_range_label) |
| Quick time ranges | 6 buttons (10M/30M/1H/6H/12H/ALL) — identical to other screens |
| Mark all as read | ✓ — readAllAlarm() — marks all unacknowledged alarms on the screen as read at once |
Timeline area (alarm_timeline) | Alarm markers shown by color along the time axis |
| No data | "No data" message (alarm_timeline_no_data) |
Marker colors follow the priority (Status Codes): Information (green) / Warning (orange) / Critical (red).
Left — Recent List Table
The left col-lg-9 area. Displays the most recent 1,000 alarms in reverse chronological order.
| Column | Width | Description |
|---|---|---|
| 🔔 | 30px | Alarm bell icon |
| Alarm number | 100px | Domain alarm ID |
| Severity | 80px | INFO/WARN/ERROR color badge |
| Alarm start/end time | 160px | Two lines — raised/cleared times |
| Tag | Location | 350px | Tag ID + location (asset path) |
| Content | Auto | Alarm message body |
| Read | 60px | ✓ toggle (read/unacknowledged) |
Clicking a row opens the alarm detail screen (/alarm/view), where you can review the data, assets, and related work orders at the time of occurrence.
Right — Statistics & Ranking Panels
The right col-lg-3 area contains two panels.
Statistics Panel
| Item | ID | Description |
|---|---|---|
| Headline | alarm_count_label | "Alarms found: N" in large text |
| Trend sparkline | alarm_trend_spark_line (150px) | Alarm occurrence trend over the search period |
| Priority donut | alarm_priority_count_chart (150px) | Information/Warning/Critical distribution |
| ON/OFF donut | alarm_onoff_count_chart (150px) | Active (is_on=Y) / cleared (is_on=N) distribution |
| Visual analysis (button) | — | Top right → opens the Visual Analysis screen |
| Empty state message | stats_no_data | "No data" |
Ranking Panel (3 tabs)
| Tab | ID | Displays |
|---|---|---|
| By tag/alarm type | rank_container | Ranking of tags and types with the highest alarm frequency |
| By connection | rank_opc_container | Alarm frequency ranking per OPC/Edge |
| By asset | rank_asset_container | Alarm frequency ranking per asset (equipment) |
If a tab has no data, a "No data" message is shown.
Alarm Help
Information box at the bottom of the screen.
❓ Alarm Help Monitors alarm messages received in real time.
- The timeline and list show the most recent 1,000 alarms in reverse chronological order.
- To search all alarms in detail by period, tag, or priority, use the [Advanced Search] button.
- To add a compound-condition alarm based on EQL (Event Query Language), click the [Add Advanced EQL Alarm] button.
Alarm Advanced Search Screen (/alarm/advsearch/index)
🔔 알람 고급검색 [← 알람 이동] [↻] [☰ ▼]
조건 기반 알람 고급 검색 / 다중 필터 분석
The layout consists of an asset tree panel on the left and four stacked panels on the right: a two-column search form + statistics chart area + result list.
Page Header · Hamburger Menu
Actions on the right of the page header:
| Button | Action |
|---|---|
| ← Go to Alarms | Opens the alarm summary screen |
| ↻ Refresh | Reloads the tree and results |
| ☰ Hamburger ▼ | Dropdown — quick navigation to Alarms / Alarm Advanced Search / Alarm Visual Analysis / Advanced EQL Alarms |
Left — Model Tree Panel (col-lg-3)
Same tree structure as on other screens; the panel header subtext reads "Asset/connection tree by site". Three tools on the right of the header:
| Icon | Action |
|---|---|
| 💬 (speech bubble) | Toggles display of tag descriptions |
| 🔍 (magnifier) | Toggles the in-tree search input |
| 📋 (copy) | Copies the selected tag name to the clipboard |
Below the site selector are two segmented tabs — 🗂 Assets / 🌐 Connections (the Connections tab appears only for ADMIN privileges). The footer shows an object ID preview — hovering over a tree node displays its domain ID.
Right ① Alarm Search Panel (form)
Panel header subtext: "Search by period, severity, active state, read state, and content".
Row 1 — Basic Filters (four fields in one row)
| Field | Width | Options |
|---|---|---|
Alarm period (alarm_time) | Wide | Date-time range (calendar picker — start to end) |
Severity (priority) | Normal | All / Information (INFO) / Warning (WARN) / Critical (ERROR) |
Active (is_on) | Normal | All / Active (Y) / Ended (N) |
Read (is_read) | Normal | All / Read / Unread |
Row 2 — Content Search + Search Button
| Field | Width | Options |
|---|---|---|
Content (description) | Wide | placeholder: "Search content..." — keyword in the alarm message body |
| 🔍 Search button | Right-aligned | Red primary — searches using the conditions above combined with all tag IDs of the asset selected in the left tree |
You must select an asset in the left tree for the search to be limited to alarms on that asset's tags. Select a site or asset in the tree first — searching without a selection targets all sites.
Right ② Alarm List Panel
The ✓ Mark all as read button sits at the right of the panel header — it marks every unacknowledged alarm in the search results as read at once.
Statistics Chart Area (above the list, shown only when results exist)
| Area | Content |
|---|---|
| Priority donut | Left 250px — INFO/WARN/ERROR share donut (150px height) |
| Time series spark | Right, auto width — sparkline of alarm volume over the search period (150px height) |
When there are 0 results, the statistics area is hidden and a "No data" message is shown with 30px padding.
Results Table (8 columns)
| Column | Width | Displays |
|---|---|---|
| 🔔 | 30px | Bell icon |
| Alarm number | 100px | Alarm serial number — click to open the alarm detail screen |
| Severity | 80px | Information/Warning/Critical color badge |
| Alarm date | 160px | Time raised (yyyy-MM-dd HH:mm:ss) |
| Tag name | 200px | Originating tag (domain badge + name) |
| Content | Auto | Alarm message body |
| Read | 40px | Read check icon |
| Read date | 100px | Time marked as read (- if unacknowledged) |
The table supports DataTable sorting, paging, and CSV export. To retrieve many results at once, use the page size selector on the left of the table to choose 100/All.
Alarm Visual Analysis Screen (/alarm/analysis/index)
A screen for analyzing alarm data through a variety of visualization charts.
Chart Library (8 types)
| Chart | JSP | Description |
|---|---|---|
| Day-of-week / hour heatmap | chart/heatmap.jsp (74 lines) | Day × hour cell heatmap — shows where alarm occurrences concentrate |
| Hourly trend | chart/hourly.jsp | Occurrence frequency by hour over 24 hours |
| Day/hour matrix | chart/matrix.jsp | Cross-analysis of day of week and hour |
| Ranking by tag | chart/tag-rank.jsp | Ranking of tags with the most alarms |
| Treemap | chart/treemap.jsp | Alarm distribution by area across the asset/tag hierarchy |
| EventDrops | chart/eventdrops.jsp (53 lines) | Multi-series point visualization along a time axis — pattern identification |
| Priority distribution | chart/priority.jsp | INFO/WARN/ERROR distribution over time |
| Day/hour distribution | chart/day-hour.jsp | Distribution in a day-of-week / hour coordinate system |
Procedure
- Enter conditions such as analysis period and site at the top
- Review each chart for meaningful patterns
- Narrow down to the times and assets where patterns appear via Alarms or Alarm Advanced Search for detailed inspection
- If threshold adjustment is needed, edit the rule on the Advanced EQL Alarms screen
Visual analysis is suited to after-the-fact pattern analysis of operations. For real-time monitoring, use the Alarm screen.
Advanced EQL Alarm Screen (/alarm/config/index)
🔔 알람 | 고급 EQL 알람 [← 알람 이동] [↻] [▼] [➕ 알람 설정 추가]
A screen where you define EQL rules to raise alarms on arbitrary conditions. (Similar to a CEP trigger, but dedicated to alarm publishing.)
List Table
The right side of the list panel header has three buttons: Deploy selected alarm configuration / Undeploy / Redeploy all.
| Column | Width | Description |
|---|---|---|
| Select | 50px | Checkbox for bulk deploy/undeploy |
| Status | 80px | Deployed/undeployed badge |
| Alarm configuration ID | 150px | System-assigned ID |
| Alarm configuration name | description | 200px | Operator metadata |
| Severity | 80px | Priority of the alarm to be raised (INFO/WARN/ERROR) |
| Message | Auto | Message body used when the alarm is raised |
| Total execution count | 70px | Cumulative number of matches |
| Last execution date | 110px | Most recent match time |
| Errors | 70px | Cumulative error count |
| Created | 110px | |
| Last modified | 110px | |
| Actions | 80px | Edit, delete |
Alarm Configuration Form
Use Add alarm configuration at the top or a row action to open the form screen (/alarm/config/form).
| Input | path | Description |
|---|---|---|
| Alarm configuration ID | alarm_config_id | Read-only (auto-assigned) |
| Alarm configuration name | alarm_config_name | Human-readable identifier |
| Description | alarm_config_desc | Note on the rule's purpose |
| EQL | epl | Alarm matching condition (e.g., SELECT * FROM Point WHERE value > 100) |
| Severity | priority | INFO / WARN / ERROR |
| Message template | alarm_message | Supports variable substitution such as ${태그ID} |
| Occurrence window | window | Time span in which a repeating identical condition raises only one alarm |
After saving, check the rule in the list → Deploy selected alarm configuration → the rule becomes active and starts raising alarms.
EQL alarms can also be generated automatically from the
flow_create_alarm_confignode in Flow.
Alarm Detail Screen (/alarm/view/{alarm_seq})
Clicking an alarm on the Alarm or Advanced Search screen opens its detail screen. It is an analysis view that gathers a single alarm and its surrounding context (tag, data, other alarms, statistics, recipients) into one screen.
Top — Identification Header
🔔 알람 | {alarm_seq} [ 사이트 > 구역 > 라인 > 설비 > 태그명 ]
| Area | Action |
|---|---|
| ← Previous screen | back() — returns to the previous alarm list screen |
| Refresh | refresh() — reloads the screen |
Panel 1 — Alarm Information (panel 알람 정보)
A single-row table of the alarm's key information plus a Mark all as read button.
| Column | Width | Description |
|---|---|---|
| Severity | 200px | INFO/WARN/ERROR color badge |
| Active | 60px | is_on Y/N |
| Alarm start time | 120px | Time raised |
| Alarm end time | 120px | Time cleared (- while still active) |
| Tag | 400px | 🏷 Tag name — click to open tag details |
| Message | Auto | Alarm body |
| Read | 100px | ✓ toggle (read/unacknowledged) |
Data Context fieldset
Shows the tag's data for the query window around the time the alarm was raised, in table form. A Go to trend (goStorage()) button is on the right of the header.
| Column | Width | Description |
|---|---|---|
| Timestamp | 180px | Measurement time |
| Value | 200px | Tag value at that time |
| Unit | 50px | Unit of measure |
| Data type | 100px | INT/FLOAT/BOOL, etc. |
| Quality | 100px | Data quality code |
| Error code | 100px | Error at that time (if any) |
| Latency [MS] | 100px | Ingestion latency |
| Attributes | Auto | Additional attributes |
Review tag values immediately before and after the alarm at a glance, and use Go to trend to analyze a longer time series.
Alarm List fieldset
Other alarm history for the same tag over the same period (${date_from} ~ ${date_to}). Use Go to alarms (goAlarm()) on the right to return to the Alarm menu.
| Column | Width | Description |
|---|---|---|
| 🔔 | 30px | Alarm bell icon |
| Alarm number | 100px | Alarm ID |
| Severity | 80px | INFO/WARN/ERROR |
| Alarm date | 160px | Time raised |
| Tag | 250px | Tag name for that alarm |
| Content | Auto | Alarm message |
| Read | 60px | ✓ toggle |
| Read date | 160px | Time marked as read |
This table shows at a glance whether the same tag raised other types of alarms during the same period.
Alarm Trend Panel
Visualizes the alarm occurrence trend over the period as time bars. Shows occurrence frequency and patterns (such as concentration in specific hours).
Alarm Statistics Panel
Summary statistics of alarm occurrences. Counts by priority and by ON/OFF are shown as donuts and bars.
Alarm Recipients Panel
Information on the users/groups that should receive this alarm. If notification automation is wired up, the recipient list (email/SMS) is shown as well.
Tag Information Panel
Detailed information on the tag that raised the alarm — configuration, alarm bands, validation, OPC mapping, and metadata. See tag details for the individual items.
Usage Patterns
| Analysis flow | Screen flow |
|---|---|
| Root-cause analysis of an alarm | Alarm information → Data context table (trend of preceding values) → Go to trend (time series 30 minutes before and after) |
| Tracking recurring alarms | Alarm list fieldset → other alarms on the same tag → identify the pattern |
| Threshold review | Tag information panel → check alarm band settings → recalculate thresholds with Forecast Analysis |
| Recipient verification | Alarm recipients panel → who received this alarm |
Usage Scenarios
| Scenario | Screen | Procedure |
|---|---|---|
| Check currently active alarms | Summary | Open the page → bell badge at top right + alarms in ON state in the left list |
| Analyze yesterday's ERRORs | Advanced Search | Period = yesterday / Priority = ERROR / select site |
| Day/hour alarm patterns | Visual Analysis | Identify the darkest days/hours on the heatmap chart |
| Adjust thresholds for recurring alarms | Advanced EQL Alarms | Edit the alarm rule → change the threshold → redeploy |
| Identify alarm floods by device | Visual Analysis → Treemap | Assets with large areas → run Advanced Search on that asset only |
| Automatic alarm notification | Flow | flow_on_alarm trigger → send email/SMS |
Frequently Asked Questions
Q. Can the 1,000-entry limit on the Alarm screen be raised? A. The Alarm screen is fixed at 1,000 entries as it is intended for monitoring. To view more alarms, go to Alarm Advanced Search, or narrow the period and query more often.
Q. Do alarms disappear when I click "Mark all as read"?
A. No. They are only flagged as read; active alarms remain active (is_on does not change).
Q. I want to send email/SMS automatically when an alarm is raised.
A. On the Flow screen, wire a flow_on_alarm trigger to a flow_send_email / flow_send_sms node to automate this.
Q. I registered an EQL alarm, but it never fires. A. Defining it is not enough to activate it. Check the alarm configuration in the list and click Deploy selected alarm configuration so the rule is registered with the engine and matching begins.
Q. What does area represent in the Visual Analysis treemap? A. The cumulative frequency of alarms raised on that asset/tag. The larger the area, the more alarms that asset produced.
Q. Alarm priority colors look slightly different from screen to screen. A. Only the shade differs slightly by area; the meaning is the same. See Status Code Definitions for the exact color mapping.
Q. Which variables can I use in the alarm message template?
A. You can use field names from the EQL result directly as variables, such as ${tag_id}, ${value}, ${asset_id}, and ${timestamp}.
Q. How can I keep the raised-alarm history for a long time?
A. Increase the default retention period, or use the flow_on_alarm trigger in Flow to load the data automatically into an external system.
Q. Why is the ON/OFF donut always 100% ON? A. This happens when there are no cleared alarms in the search results — every alarm was raised as active and has not yet been cleared.
Q. What can I see on the alarm detail screen? A. Context information such as the tag data at the time the alarm was raised, related assets, other alarms in the same time window, and related work orders.
Related Screens
- Dashboard — today's alarms on the KPI cards and the alarm count on the diagnostics panel
- Daily Statistics — comparative alarm analysis by site, asset, and tag
- Data Points — alarm display options on trend charts
- CEP — the parent concept of alarms (event rules)
- Flow — automatic alarm routing and notification automation
- Status Code Definitions — alarm priority colors
- Equipment — today's alarm counts on the cards (information/warning/critical)