Alert-Type Categories and Definitions

Battery Health

Creates an alert when the remaining battery life reaches 62%

Example Alert: Battery z3412 health is low at 62%

Battery Over Current

Creates an alert when the battery's current reaches 3.2 amps (3200 mA)

Example Alert: Battery a267 is over current at 3.2amps

Battery Over Temperature

Creates an alert when the battery's temperature reaches 50 degrees Celsius

Example alert: Battery b723 is over temperature at 50 Celsius

Battery Over Voltage

Creates an alert when the battery's recommended voltagereaches8.5V (8500 mV)

Example alert: Battery c423 is over voltage at 8.5volts

Battery System Low Power

Creates an alert when the battery's power reaches 20% charge

Example alert: Battery system is at 20% charge with 60 minutes remaining

Battery System Power Off

Creates an alert when the battery's power reaches 7% charge

Example alert: Battery system is at 7% charge with 10 minutes remaining

Battery Maintenance Cycle Started

The battery automatically begins discharging then recharges to full power, for optimizing battery life. (E400/X20 devices)

Battery Maintenance Cycle Ended

The battery has finished its maintenance cycle. (E400/X20 devices)

Battery Backup Power Engaged

When an E400/X20 device loses wall power and switches over to battery backup.

Wall Power Restored

When an E400/X20 device regains wall power and switches back from battery backup mode.

Pooled Carrier Data Usage

Creates an alert when a user-defined usage percentage is met for a pooled data plan.

Carrier Data Usage Per Router

Creates an alert when a user-defined usage percentage is met for a single router.

Configuration-related alerts

Configuration Changed

Occurs when there has been a local configuration change.

Configuration Rejected

Occurs when a configuration change was sent to the device but was rejected

Configuration Unacknowledged

Occurs when a configuration change was sent to the device but was not acknowledged by the device.

Ethernet WAN Connected

Indicates that an Ethernet WAN device is now active.

Additional threshold setting:

Only send alert if previously disconnected more than: x Seconds

A connection notification is sent only when an Ethernet WAN device connects after the specific time threshold is exceeded. Enable this setting to reduce notifications in situations where an Ethernet WAN device will reconnect quickly or when the disconnect was planned. The default is 120 seconds.

Ethernet WAN Disconnected

Indicates that an Ethernet WAN device is no longer active.

Additional threshold setting:

Only send alert notification if Ethernet doesn't reconnect in less than: x Seconds

A disconnection notification is not sent unless an Ethernet WAN device connects after the specified threshold is exceeded. Enable this setting to reduce notifications in situations where an Ethernet WAN device will reconnect quickly or when the disconnect was planned. The default is 120 seconds.

Ethernet WAN Plugged In

An Ethernet WAN device is now attached

Ethernet WAN Standby

An Ethernet WAN device is in standby mode

Ethernet WAN Unplugged

An Ethernet WAN device has been removed

Data Cap Threshold

Occurs when a data cap threshold is reached

Example alert: The (Internal LTE/EVDO Port:int1) rule exceeded 100 percent of its 150 MB daily cycle.

Device Location Unknown

Occurs when no location is reported for 24 hours on a device with Location Services (GPS) enabled. If a manual location is used the alert is not generated.

Device Registration

Allows for email or webhook alerts any time a device is registered or unregistered from an account. While this information is also available in the Activity Log, this alert allows for notification of registration and unregistration.

Geofence Proximity Change

Occurs whenever the device enters or exits the specified Geo-fence

IP Verify Test Result

Occurs when an IP Verify test is complete.

IPSec VPN Tunnel Up

Occurs when an IPSec tunnel is initially connected.

IPSec VPN Tunnel Down

Occurs when a connected IPSec tunnel is disconnected.

IPSec VPN Tunnel Restored

Occurs when a connected IPSec tunnel reconnects after being disconnected.

Microsoft IoT Disconnect

Occurs when a Microsoft IoT device disconnects.

Modem Software Update Available

Occurs when new modem software is available for download. Includes the version number of the new software, the products to which it applies, and a link to the Release Notes.

NCM Connection State

Occurs when the device loses or regains its connection to NetCloud Manager. A device must be online or offline for 60 seconds before this alert is generated. See Details on NetCloud Manager Connection State Online and Offline Alerts for details.

Example alert: The device entered the "online" state.

NetCloud OS Update Available

Occurs when new NetCloud OS software is available for download. Includes the version number of the new software, the products to which it applies, and a link to the Release Notes.

Additional options available:

NetCloud OS Upgrade Completed - Routers

Occurs when the device's NetCloud OS is upgraded.

Reboot

Occurs when the device is rebooted.

Additional threshold setting:

Only send if reboot not for NCOS upgrade

Enable this setting to eliminate Reboot notifications when upgrading NCOS firmware.

Example alert: The device has been rebooted.

Remote Connect Ended

A remote connect session to the specified router has been closed.

Remote Connect Started

A remote connect session to the specified router has been opened.

Router Group Change

The specified router has been moved or added to the specified group. Also includes the username associated with the move, the date and time, the group the router was in previously (if applicable) and the group to which the router was added (if applicable).

Tunnel Limit Reached

Occurs when the number of IPSec tunnel connections has met or exceeded either 90% or 100% of the maximum tunnel limit.

Webhook Suspended

Previously configured webhook is in a suspended state.

ADC Voltage Event

Occurs on devices with voltage-sensing systems when a voltage limit is reached, and also when the voltage returns to within the accepted range.

Example alert:ADC on channel 1 is below 3.0V limit at 2.5V.

GPIO State Change

Occurs when a device's GPIO pin has changed state. To view or update the GPIO configuration, open the Device UI and select the System > GPIOs tab. This alert requires NetCloud OS 6.0.2 and newer, and a Cradlepoint device with GPIO.

SIM Door Event

Occurs when the SIM door opens or closes.

Temperature Limit Exceeded

Occurs on devices with an internal temperature sensor(COR IBR1100 and IBR1150) when a user-defined temperature limit is reached. To set the temperature limits for the COR IBR1100 Series, login to the Device UI, select System > Administration, and then click the Temperature tab.

Failover Event

A router (or group of routers) has changed the primary WAN interface from a higher- priority interface to a lower-priority interface.

CPU Utilization

CPU Utilization crossed a threshold.

IMPORTANT: Enabling the CPU Utilization alert requires that the CPU Utilization Threshold Crossed alert also be enabled in the router's configuration.

See How to configure Device Alerts on a Cradlepoint Router for more information.

Memory Utilization

Memory Utilization crossed a threshold.

IMPORTANT: Enabling the Memory Utilization alert requires that the Memory Utilization Threshold Crossed alert also be enabled in the router's configuration.

See How to configure Device Alerts on a Cradlepoint Router for more information.

Sustained System Overload

The system experienced sustained levels for CPU or Packet Loss that exceeded thresholds.

To use the Sustained System Overload alert, your account must have the Capacity Dashboard enabled. See Monitoring Throughput for more information on enabling and using the Capacity Dashboard.

System Error Requires Reboot

The router rebooted due to a system error that requires a reboot to resolve.

WiFi Client State Changed

Occurs when a WiFi client changes state. For example, when a client's state changes from connected to disconnected (requires NetCloud OS version 6.6.1 and newer).

VRRP State Changed to Master

The specified router has been become a VRRP master.

You can further configure this alert to only be sent if the router was previously a backup or in a fault state for a specified period.

VRRP State Changed to Backup

The specified router has become a VRRP backup.

You can further configure this alert to only be sent if the router was previously a master or in a fault state for a specified period.

VRRP State Changed to Fault

The specified router is in a VRRP fault state. You can further configure this alert to only be sent if the router was previously a backup or a master for a specified period.

Location Service Mode Changed

Alert sent when there is change to the configuration of Location Services (including but limited to turning it on/off). This alert will contain the time and date of the change, what was changed, and the device or group to which it was applied.

Modem WAN Connected

Indicates that a modem WAN device is now active.

Additional threshold setting:

Only send alert if previously disconnected more than: x Seconds

A connection notification is sent only when a modem WAN device connects after the specific time threshold. Enable this setting to reduce notifications in situations where a modem WAN device will reconnect quickly or when the disconnect was planned. The default is 120 seconds.

Modem WAN Device Plugged In

Indicates that a modem WAN device is now attached.

Modem WAN Device Unplugged

Indicates that a modem WAN device has been removed.

Modem WAN Disconnected

Indicates that a modem WAN device is no longer active.

Additional threshold setting:

Only send alert notification if modem doesn't reconnect is less than: x Seconds

A disconnection notification is not sent unless a modem WAN device connects after the specified threshold is exceeded. Enable this setting to reduce notifications in situations where a modem WAN device will reconnect quickly or when the disconnect was planned. The default is 120 seconds.

Modem WAN Standby

Indicates that a modem WAN device's default connection state is set to Standby. This means the modem is connected to the carrier, but is not sending data. A modem in Standby will failover faster than a modem not in Standby. Standby is enabled by modifying the Default Connection State from the Device UI's Connection Manager table.

WAN Service Type

Indicates that a WAN device has changed its service type, such as switching from 3G to 4G. Possible service types include: DHCP, LTE, HSPA+, etc.

Example alert: The lte-2ae6ec8e service type has changed to LTE.

Custom Alert

Is an alert generated by custom code in an NCOS SDK app.

NCOS App Execution State Changed

Indicates that an NCOS SDK app that is running on a group has entered a different execution state (start, stop, error, etc).

Unexpected NCOS App Installed

Indicates that an unexpected NCOS SDK app is found installed, an expected NCOS SDKapp is unexpectedly uninstalled, or a that an NCOS app unknown to the system is found installed.

Account Locked

Occurs after six failed login attempts on devices with Advanced Security Modeenabled. The account remains locked for 30 minutes. To enable this setting, login to the Device go to System > Administration>Router Security and select Advanced Security Mode.

Additional settings: Account lock alerts can further by refined by selecting Routers or NetCloud.

Selecting only Routers sends alerts when a user enters too many incorrect passwords while attempting to access NCOS.

Selecting only NetCloud sends alerts when a user enters too many incorrect passwords while attempting to access NetCloud Manager.

Failed Login Attempt

Occurs when a login fails on the Device UI login screen.

Additional settings: Failed login attempt alerts can further by refined by selecting Routers or NetCloud.

Routers alerts include details such as the type of failed login attempt (wrong password, for example.)

NetCloud alerts include the time and date of the failed login attempt, the username, and the source IP address.

Example alert: An attempt to log in as the admin user from 192.168.0.142 has failed

Intrusion Activity

Is only relevant for devices with CP Secure Threat Management. Whenever the Threat Management deep packet inspection engine detects an intrusion, that event is recorded in the logs. These events are grouped together for 15 minutes and then reported in NetCloud Manager, so an emailed alert notification might not arrive for approximately 15 minutes after an intrusion. Intrusion Activity alerts include the intrusion details and the action taken by the engine (e.g., Blocked). To edit Threat Management settings, login to the Device UI and select Security> Threat Management. For more information, see Manual: Network Settings → Threat Management.

IP Address Banned

Occurs if the Ban IP Address setting is turned on for a device and someone from a particular IP address attempts and fails to log into the Device UI six times, that IP address is banned for 30 minutes. To enable this setting, login to the Device UI and go to System > Administration >Router Security and click on Advanced Security Mode. Select the Ban IP Address option.

IPS Engine Failure

For devices using Cradlepoint Secure Threat Management (CPSTM), this alert occurs in the unlikely event that the Threat Management engine fails. You can set the router to either allow or deny traffic with a failure. To edit this setting, log in to the Device UI and go to Security> Threat Management.

IPS Enablement Change

Occurs when Intrusion Prevention Systems / Intrusion Detection Systems (IPS/IDS) has been enabled or disabled using Cradlepoint Secure Threat Management (CPSTM) and provides details about who made the change and when it occurred.

IPS Mode Change

Occurs when the IPS/IDS mode has been changed (for example, from Detect and Prevent to Detect Only) using CPSTM and provides details on what changed, who made the change, and when it occurred.

Rogue Access Point Detected

Occurs after running a WiFi site survey when a rogue access point not marked as "known" is detected broadcasting the same SSID as the device running the site survey. This helps identify potential access-point hijacking, evil twin, and man-in-the-middle WiFi attacks.

SCEP Enrollment Success

This alert is generated when a device successfully enrolls with a SCEP server.

SCEP Enrollment Failure

This alert is generated when a device attempts to enroll with a SCEP server but can't enroll successfully.

Successful Login (Router)

Indicates that a user has logged into the Device UI(requires at least NetCloud OS 5.0.1).

Unrecognized Client

Indicates a client with an unrecognized MAC address has attempted to connect to the device. MAC logging must be enabled to trigger this alert. To enable MAC logging, login to the Device UI and go to Networking > Local Networks> MAC Filter & Logging and select Enable MAC Logging.

Zscaler TLS Tunnel State

Indicates the state of a Zscaler tunnel has changed.

Non-Compliant Devices

Indicates account has new non-compliant devices.

Unlicensed Devices

Indicates account has new unlicensed devices.

Subscriptions Expiring XXX Days

Indicates account has subscriptions expiring in 180/90/60/30/15/5 days. See Alerts Not Supported for Use in Webhooks for notification limitations with Subscriptions Expiring alerts. See potential issues when using this alert.

Devices Unlicensed in 15 Days

Indicates account has devices unlicensing in 15 days.

Devices Unlicensed in 5 Days

Indicates account has devices unlicensing in 5 days.

WiFi as WAN Connected

Indicates WiFi as WAN is now active.

WiFi as WAN Disconnected

Indicates WiFi as WAN is no longer active.

WiFi as WAN Network Available

Indicates a WiFi as WAN network is now attached.

WiFi as WAN Network Unavailable

Indicates a WiFi as WAN network has been removed.

WiFi as WAN Standby

Indicates a WiFi as WAN network is in standby.

Reboot

The cellular AP has rebooted.

NTP Sync Issue

The cellular AP cannot reach the NTP server and may have incorrect system time.

Cellular Radio Status

The cellular AP radio interface has entered the specified state.

AP/Core Connection State

The cellular AP specified service type connectivity to the packet core entered the specified state.

High Temperature

The cellular AP is operating at a high temperature.

SAS Grant Success

The cellular AP received a CBRS SAS grant successfully.

SAS Grant Suspended

A CBRS SAS Grant was suspended for the cellular AP.

No SAS Response

The cellular AP did not receive a response from the CBRS SAS server.

SAS Grant Terminated

A CBRS SAS Grant was terminated for the cellular AP.

SAS Grant Expired

A CBRS SAS Grant has expired for the cellular AP.

IPsec Tunnel Setup Failure

The cellular AP failed to setup an IPsec tunnel with the specified packet core.

High Temperature

The cellular AP has reached a critical operating temperature which may impact performance.

NTP Sync Issue

The packet core cannot reach the NTP server and may have incorrect system time.

Interface Status

The packet core specified interface has entered the specified state.

IPsec Connection State

The packet core IPsec connectivity to the specified cellular AP entered the specified state.

S1 Setup Failure

The packet core failed to setup an S1 connection with the specfiied cellular AP.

S1 Connection State

The packet core S1 connectivity to the specified cellular AP entered the specified state.

NCM Connection State

The device entered the specified state.

GBR Bearer Setup Failure

The device with the specified IMSI failed to connect to its requested QCI because the guaranteed bitrate requirement could not be met.

Test Started

All preconditions have been met for CSI to start.

Test Passed

A carrier has met or exceeded the benchmarks for a speed test.

Test Failed

A carrier has failed to meet the benchmarks for a speed test.

Test Error

A speed test has encountered an error.