Operator Console Invisible Alarms

[Larry Fitzgerald]

Hello,

I recently noticed that the ACL permission Invisible Alarms is not working correctly for our environment.  This is in both 20.4 and 20.3.3.

Per documentation:

Administrators can set whether an alarm is visible to other users. You might want to set some alarms to invisible to hide them if they are not relevant to other users. You can quickly set a single alarm to invisible (or visible) by clicking the appropriate 

Set invisible or Set visible

, or you can select multiple alarms and can set them to invisible (or visible) by choosing a menu item.

You must have the 

Invisible Alarms 

permission to set alarms as invisible and to view invisible alarms.

In v20.3.3, the absence of this permission does remove the ability to show invisible alarms with the toggle button.  However, users can still set the alarm to invisible.

In v20.4, the absence of this permission does remove the ability to show invisible alarms by removing the Include/Exclude Invisible menu item.  However, users can still set the alarm to invisible.

Anyone else seeing this behavior?  Looks like a bug to me.

Thanks,

Larry

[Larry Fitzgerald]

I ended up opening a case on this and here is support's reply.  Our users are using the annotation function, so requested they decouple invisible option from annotation.

It appears that this is actually caused by the "Alarm Management" ACL permission being enabled:

in my lab I was able to determine the following:

- if an ACL has "Alarm Management" but not "Invisible Alarms" they can still set alarms invisible but not view them;
- if an ACL has "Invisible Alarms" but not "Alarm Management" they can still set alarms invisible and view them;
- if an ACL has neither "Invisible Alarms" nor "Alarm Management" they can not set alarms invisible or view them.

Checking further it appears that "Alarm Management" enables two things:

- ability to set invisible alarms
- ability to set alarm annotations

If your users are not using alarm annotations, then you could remove the "Alarm Management" ACL as an alternate workaround so that you could hide the invisible alarms as intended.

The other "actions" you can do with an alarm, such as Assign, Accept, Acknowledge, are controlled by individual ACL permissions so it seems that the ability to add Annotations is the only impact - I am not sure if that is something you are using in your environment currently but I thought it was worth mentioning in case that was a better trade-off than allowing the users to see the invisible alarms.

Meanwhile a defect is on its way to development and I will let you know the outcome.

[Nico Mueller]

Good work.
Seems like thats one of the many details broadcom just didnt care about while rushing out 20.3

I also had the motivation shortly after 20.3 release to find those things.
But I recognized its unpayed work and in most of the cases they are trying to delay the development to the next version.

[Ziv Leibovich]

Hi,

Did anything changed, it's 2026 and the permissions are still coupled.

I want to allow annotation, and I get Set Invisible as a bonus (-:
This is so disastrous as the operators can put something to invisible and not even know. 

Did you get a solution for the case?

-------------------------------------------

[Stephen Danseglio]

Hi Ziv, Larry, et al,

Jason Allen and I both have reminded Product Management as well as Engineering about this previously entered feature request. Besides the details discussed here and in the request, overall we should be adhering to the security principle of least privilege as well.

Best Regards,
Steve

------------------------------
Steve Danseglio
Senior Principal Support Engineer (Technical Support Engineer 5)
Broadcom Software-IMS Division
UIM Certified Expert
KCSv6 Practices Certified
Certified Customer Success Manager (CCSM) Level 1
Generative AI Leader (Google Cloud)
------------------------------