Alert trigger methods

There are several methods available for triggering alerts in Devo. Here we describe the five methods and offer examples for each.

Each

The each method triggers an alert for each new event that meets the query conditions.

To create a query that can be used to trigger a simple alert, you can apply filters to data and create new columns, but groups and aggregated values are optional.  

The threshold for this kind of alert is defined by the filters you have applied in the query. So, each time that an event is written to the data table and meets the conditions of your query, an alert will be triggered.

An example of a simple alert based on firewall log data might be to trigger an alert whenever there is a connection attempt from a blacklisted IP address. In this case, the query should be filtered to include only events where the source IP addresses are confirmed to also appear on a blacklist lookup table.

Several

The several method triggers an alert when a given number of events occur within a given time period. 

To create a query that can feed an alert using this trigger method, you can apply filters and create new columns, but do not group the table's events.

The threshold for this kind of alert is defined by the time period and the threshold number of events you specify. So, the alert process will maintain a count of events that meet the conditions of your query over the last time period and, trigger an alert with the threshold number has been exceeded. The time period is rolling, that is to say that if your chosen time period is 1 hour, the alert will maintain a running count of events over the last 60 minutes.

An example of this trigger method based on firewall log data might be to trigger an alert whenever there are more than 500 connection attempts from a single IP address within a 1-minute period. 

Low

The low method follows the same principle as the several method except that it triggers an alert when the threshold is not met.

An example might be an alert set to trigger based on heartbeat events since we want to be notified when a system is not sending it's heartbeat events when expected.. 

Deviation

The deviation method triggers an alert every time the aggregated value of a single grouped element is significantly higher or lower than the group's median value. 

To create a query that can be used to trigger a deviation alert, you can apply filters to data and create new columns as usual.  But you must group table events by at least two elements (usually by time, then by other table fields) and add just one aggregated value.

You can express the threshold for this kind of alert by either the absolute deviation or a percentage. So, each time that the aggregated value of a grouped element varies significantly from the median value of all the elements within the same grouping period, an alert will be triggered. 

Let's use an example. Say we want to trigger an alert when the response time of a server within a balanced architecture is significantly higher (or lower) than the average. In this example, we group the events by a time period and server name, then add the aggregated value of average response time.

Gradient

The gradient method triggers an alert every time the aggregated value of a grouped element varies significantly from one grouping period/set to the next.

To create a query that can use the gradient trigger method, apply filters to the data and create new columns as needed.  But you must group table events by at least two elements (usually by time, then by other table fields) and add just one aggregated value.

You can express the threshold for this kind of alert by either the absolute deviation or a percentage. So each time that the aggregated value of a grouped element varies significantly from one grouping period to the next, an alert will be triggered.

Let's use an example. Say we want to be alerted when the average response time of any server is significantly longer or shorter than in the previous grouped period. As is the previous example, we group the query data by a time period and server name, then add the aggregated value of average response time.