Severity & Status Codes

Event severity

GridNMS uses a single 5-level severity scale everywhere for events, cases, and detections:

Level	Name	Color	Use
1	Critical	Red	Total outage, link down
2	Major	Orange	Serious but non-total impact
3	Minor	Amber	Threshold breach, degraded state
4	Warning	Yellow	Worth noting, not yet a problem
5	Info	Blue	Routine informational (a device came back up, a link came up)

When a detection has a severity threshold, you’re choosing the maximum level to be notified about — a threshold of 3 notifies on Critical, Major, and Minor.

Events are immutable

An event is a point-in-time record of something that happened — it’s written once and never changes, so there’s no open/acknowledged/closed status on an event itself. The ongoing investigation lifecycle (open → investigating → resolved → closed) lives on Cases: a detection can group related events into a case, and that case is what you triage. An event that recovers (for example a device coming back up) is its own new event, not an edit to the original one — the two are linked by a shared tag so you can see the down/up pair together. See Events & Alerts.

Device reachability

Alive value	Meaning
1	Up
0	Down
(none)	Unknown — not yet polled

Common event tags

Tag	Raised by	Meaning
PING_DOWN	Device Down detection	Device became unreachable (Critical)
PING_UP	Device Down detection	Device returned (Info); pairs with PING_DOWN

See Events & Alerts for how detections turn raw signal — reachability, SNMP traps, log lines — into tagged events, and how to author your own.