# Diagnostics for alerted issues

The Diagnostics dashboard streamlines the process of resolving issues that are impacting multiple devices. View alert information and underlying events to understand why the system triggered the alert, and how to troubleshoot the issue.

## Monitors supported by the Diagnostics dashboard <a href="#diagnosticsforalertedissues-monitorssupportedbythediagnosticsdashboard" id="diagnosticsforalertedissues-monitorssupportedbythediagnosticsdashboard"></a>

The primary objective of the Diagnostics dashboard is to efficiently address issues affecting multiple devices. As such, it is not available for alerts triggered for an individual device or an individual user.

The Diagnostics dashboard currently supports the following monitors:

* Built-in monitors with metric change detection
* Built-in monitors with event metric threshold detection.
* [VDI monitors installed from the library ](https://docs.nexthink.com/platform/user-guide/getting-started-with-alerts#monitors-for-virtual-desktop-infrastructure-vdi)use real-time events to trigger virtual desktop infrastructure environments.
* Custom monitors that track aggregated event metrics
* Custom monitors that track the summarized number of devices with issues based on an event metric.

{% hint style="warning" %}
The system does not generate a diagnostics view if the first metric in the trigger condition is an object count, such as `device.count()`. To enable diagnostics, the monitor must rely on an event metric or a computation derived from it.
{% endhint %}

{% hint style="info" %}
For some rare custom monitors, the system may not yet be able to generate a troubleshooting dashboard. Nexthink will continue to improve dashboards for custom monitors in coming releases.
{% endhint %}

## Diagnostics dashboard scope <a href="#diagnosticsforalertedissues-diagnosticsdashboardscope" id="diagnosticsforalertedissues-diagnosticsdashboardscope"></a>

### Metric <a href="#diagnosticsforalertedissues-metric" id="diagnosticsforalertedissues-metric"></a>

The content on the dashboard changes dynamically depending on the alerted issue and whether the monitor type is *metric change* or *metric threshold*.

Additionally:

* For custom monitors that evaluate more than one metric, the system only shows the metric that is used as the first aggregated metric in the monitor conditions.
* For custom monitors that track the summarized number of devices with issues based on an event metric, the system selects the event metric by analyzing the monitor query.

### Timeframe <a href="#diagnosticsforalertedissues-timeframe" id="diagnosticsforalertedissues-timeframe"></a>

The system preselects the timeframe based on the triggered alert. You cannot change this timeframe.

### Monitor query filters <a href="#diagnosticsforalertedissues-monitorqueryfilters" id="diagnosticsforalertedissues-monitorqueryfilters"></a>

All filters applied in the monitor NQL query that are relevant for the monitored event metric are reflected in the Diagnostics dashboard.

* A simple filter with a single value that includes data available in dashboard breakdowns is visible in the filter area. Remove the filter or apply it by clicking on the items in the breakdown charts.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-05a1dc3817c907a97a4c0119828bc62e856218bb%2Falerts-filter.png?alt=media" alt="Alerts filter.png" width="720"><figcaption></figcaption></figure>

* A complex filter that can include multiple values for many properties is not directly visible in the filter area. You cannot remove this filter.

## Dashboard Summary <a href="#diagnosticsforalertedissues-dashboardsummary" id="diagnosticsforalertedissues-dashboardsummary"></a>

At the top of a **Diagnostics** page of an alerted issue you can find the monitor name, the context for which the alert was triggered and the main condition that the system is monitoring.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-ce48bd44f945a1b6ae94ddf53de4abe26a7da777%2Fdiagnosticsforalertedissues-1703854015.png?alt=media" alt="DiagnosticsforAlertedIssues-1703854015.png" width="760"><figcaption></figcaption></figure>

### Devices impacted during the last alert <a href="#diagnosticsforalertedissues-devicesimpactedduringthelastalert" id="diagnosticsforalertedissues-devicesimpactedduringthelastalert"></a>

You may also consult the number of impacted devices during the last alert in the top-right corner of the page. Consider the following:

* The KPIs only show the number of devices impacted during the last alert.
* The system regularly updates impacted devices until the alert is recovered.

Refer to the 'Understanding Impacted devices' section in the [Alerts overview](https://docs.nexthink.com/platform/user-guide/alerts-and-diagnostics/responding-to-alerts/alerts-overview) documentation.

To open the list of impacted devices:

1. Hover over the gauge to reveal the action menu.
2. Select **Drill down to devices** to open the Investigations page with the impacted devices' results.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-5727f853147e83e1a46edf56dbd766efe2a69ca2%2Fdiagnosticsforalertedissues-1703845820.png?alt=media" alt="DiagnosticsforAlertedIssues-1703845820.png" width="760"><figcaption></figcaption></figure>

## Alert timeline <a href="#diagnosticsforalertedissues-alerttimeline" id="diagnosticsforalertedissues-alerttimeline"></a>

View the timeline of the alert and the monitored metric. The monitor provides the values in the timeline, and the metric value aggregation corresponds to the monitor’s NQL query.

### Alert timeline for Metric change monitors <a href="#diagnosticsforalertedissues-alerttimelineformetricchangemonitors" id="diagnosticsforalertedissues-alerttimelineformetricchangemonitors"></a>

In the case of alerts triggered by changes in the monitored metric, i.e. **Metric change** and **Metric seasonal change** monitors, to see the timeline values:

* The metric line, in blue, represents the current metric over time (e.g., CPU usage).
* The **Baseline** line is the historical mean:
  * Global 7-day average for **Metric change**.
  * Time-of-day mean, from the last 7 days, for **Metric seasonal change**.
* Trigger boundary line:
  * For **Metric change,** the red **Threshold** line derives from the **Baseline** and the monitor-configured threshold.
  * **Metric seasonal change**, the **Threshold** line is computed from the **Baseline**, based on the monitor configured sensitivity, which is a proportion of the standard deviation (σ):
    * **slightly** = one standard deviation (±1σ)
    * **moderately** = two times the standard deviation (±2σ)
    * **highly** = three times the standard deviation (±3σ)

{% hint style="info" %}
Refer to the [Alerts FAQs](https://docs.nexthink.com/platform/user-guide/alerts-faq#how-does-the-system-compute-the-baseline-for-the-detection-methods-metric-change-and-metric-seasonal) documentation to learn how the system computes the baseline.
{% endhint %}

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-9c6cd0213bff34467cdb45a5dc0e2bc30750604f%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

### Alert timeline for Metric threshold monitors <a href="#diagnosticsforalertedissues-alerttimelineformetricthresholdmonitors" id="diagnosticsforalertedissues-alerttimelineformetricthresholdmonitors"></a>

In the case of alerts triggered by breaches in a custom-defined static threshold, i.e. Metric threshold monitors, to see the timeline values:

* Hover over the line chart to reveal the last monitored metric value KPI. If the metric is a ratio, the timeline displays the numerator of that ratio.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-0169062cdaa955fa62e3ea2d4c925ebe15951b9b%2Fdiagnosticsforalertedissues-1703857095.png?alt=media" alt="DiagnosticsforAlertedIssues-1703857095.png" width="760"><figcaption></figcaption></figure>

### Alert timeline drill-downs <a href="#diagnosticsforalertedissues-alerttimelinedrill-downs" id="diagnosticsforalertedissues-alerttimelinedrill-downs"></a>

You can delve into the monitor’s NQL queries populating the alert timeline:

1. Hover over the KPI above the timeline to reveal the action menu. The **Drill down to** options vary depending on the alert issue or monitor.
2. Select the desired drill-down option to open the Investigations page with the results of the NQL query.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-52392768d186f8d1a4687a0926a5d70b943d9f67%2Fdiagnosticsforalertedissues-1703858593.png?alt=media" alt="DiagnosticsforAlertedIssues-1703858593.png" width="760"><figcaption></figcaption></figure>

## Object-count timeline <a href="#diagnosticsforalertedissues-object-counttimeline" id="diagnosticsforalertedissues-object-counttimeline"></a>

The bar chart below the alert timeline displays the device or user count based on the monitor's metric configuration. If the metric is a ratio, the timeline shows the numerator of that ratio:

* Hover over the bar chart to reveal the object-count value.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-3bd62c3d19854664f04d7c93b019b9856fe9023e%2Fdiagnosticsforalertedissues-1703858681.png?alt=media" alt="DiagnosticsforAlertedIssues-1703858681.png" width="760"><figcaption></figcaption></figure>

## Breakdowns <a href="#diagnosticsforalertedissues-breakdowns" id="diagnosticsforalertedissues-breakdowns"></a>

The breakdown tables enable detailed scoping of the analyzed issue. Use breakdowns to filter the page and focus on the specific employee population or technical criteria.

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-cf553c32b80ee27b3f77e56c05c2abb8d4a1f321%2Fdiagnosticsforalertedissues-1703859760.png?alt=media" alt="DiagnosticsforAlertedIssues-1703859760.png" width="760"><figcaption></figcaption></figure>

* Filter results by **Technical** criteria such as the:
  * Operating system
  * Platform
  * Device model
  * Virtualization type
* **Organization**: Filter results by entity and organizational hierarchy.
* **Location**: Filter results by geolocation hierarchy. You must enable the geolocation feature first on the Product configuration page. Refer to the [Product configuration](https://docs.nexthink.com/platform/user-guide/administration/system-configuration/product-configuration) documentation for more information.

***

RELATED TOPICS

* [Getting started with Alerts](https://docs.nexthink.com/platform/user-guide/alerts-and-diagnostics/getting-started-with-alerts)
* [Managing Alerts](https://docs.nexthink.com/platform/user-guide/alerts-and-diagnostics/managing-alerts)
* [Product configuration](https://docs.nexthink.com/platform/user-guide/administration/system-configuration/product-configuration)