• Forums
    • Public Forums
      • Community Connect
      • Dynatrace
        • Dynatrace Open Q&A
      • Application Monitoring & UEM
        • AppMon & UEM Open Q&A
      • Network Application Monitoring
        • NAM Open Q&A
  • Home /
  • Public Forums /
  • Application Monitoring & UEM /
  • AppMon & UEM Open Q&A /
avatar image
Question by wim d. · Mar 25, 2014 at 05:19 PM ·

Incident rule evaluation problem

I have this incident rule that should only be triggered after the condition exists for 30 minutes. For this I created a measure to produce the metric and configured the incident rule to evaluate the average value over a period of 30 minutes. Now it seems that the incident is triggered from the first minute the condition exists. What am I doing wrong?

Here is the measure:

This is the incident rule:

This rule is not triggered as espected after 30 minutes, but immediately:

The condition only existed for approx. 20 minutes, yet the incident was triggered.

 

 

 

I use the same measure for another incident rule, that needs to be fires immediately when the value goes over 5:

That one works fine.

 

Please advice.

Wim.

Comment

People who like this

0 Show 0
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

5 Replies

  • Sort: 
  • Most voted
  • Newest
  • Oldest
avatar image

Answer by wim d. · Mar 27, 2014 at 09:47 PM

Andreas, still not convinced:

I need 2 alarms :

-1 that fires  warning when one thread is hung for more than 30 minutes

-1 that fires severe when 5 threads are hung for more than 1 minute

For that reason I created the measure with the 2 threshholds (upper severe and upper warning) , and 2 incident rules (WebSphere Concurrent Longrunning Hung Threads Detected with an evaluation period of 30 minutes and WebSphere Concurrent Hung Threads Detected with an evaluation period of 1 minute)

From what you tell me I guess I need 2 measures then?

Wim

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by wim d. · Mar 27, 2014 at 05:05 PM

If I set it to severe, will it then be evaluated against 5 or against 1 ?

Comment

People who like this

0 Show 1 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image Andreas G. ♦ · Mar 27, 2014 at 05:30 PM 0
Share

5 - because you have 5 in the upper severe threshold

If you specify "warning or severe" the condition is met if the actual value of the measure is >= the value specified in warning OR >= the value in severe. If you specify "severe" it will only trigger if the value is >= the value in severe

Andi

avatar image

Answer by Andreas G. · Mar 27, 2014 at 03:29 PM

Thats correct - and that is how it should work. However - in your case because you have specified "warning and severe" and your severe threshold is set to 1 and you will always have at least 1 thread (correct?) it will kind of trigger immediately as well. So - please try to change that setting to "severe". If this still doesnt behave as you think it should be I would open a support ticket. Maybe there is an issue as it is supposed to work as you explained.

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by wim d. · Mar 27, 2014 at 03:23 PM

I would expect that the first incident is only triggered when the situation exists for at least 30 minutes (as I understand from the documentation, the situation is evaluated over the specifued time period, in this case 30 minutes). When the value is 1 for only 20 minutes, it should not trigger an incident (as the average would be < 1: 120 times1 and 60 times 0).

In the second example the time period is only 1 minute, so it will fire quickly.

Wim.

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by Andreas G. · Mar 27, 2014 at 02:04 PM

The problem in the first case is that you have "warning or severe" in the treshold dropdown specified. Becuase you have a Warning Threshold of 1 the Incident will trigger if the Average Value is >= 1 - so - this incident triggers everytime

In the second example you selected "severe" threshold - thats why it works

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

How to get started

First steps in the forum
Read Community User Guide
Best practices of using forum

NAM 2019 SP5 is available


Check the RHEL support added in the latest NAM service pack.

Learn more

LIVE WEBINAR

"Performance Clinic - Monitoring as a Self Service with Dynatrace"


JANUARY 15, 3:00 PM GMT / 10:00 AM ET

Register here

Follow this Question

Answers Answers and Comments

1 Person is following this question.

avatar image

Forum Tags

dotnet mobile monitoring load iis 6.5 kubernetes mainframe rest api dashboard framework 7.0 appmon 7 health monitoring adk log monitoring services auto-detection uem webserver test automation license web performance monitoring ios nam probe collector migration mq web services knowledge sharing reports window java hybris javascript appmon sensors good to know extensions search 6.3+ server documentation easytravel web dashboard kibana system profile purelytics docker splunk 6.1 process groups account 7.2 rest dynatrace saas spa guardian appmon administration production user actions postgresql upgrade oneagent measures security Dynatrace Managed transactionflow technologies diagnostics user session monitoring unique users continuous delivery sharing configuration alerting NGINX splitting business transaction client 6.3 installation database scheduler apache mobileapp RUM php dashlet azure purepath agent 7.1 appmonsaas messagebroker nodejs 6.2 android sensor performance warehouse
  • Forums
  • Public Forums
    • Community Connect
    • Dynatrace
      • Dynatrace Open Q&A
    • Application Monitoring & UEM
      • AppMon & UEM Open Q&A
    • Network Application Monitoring
      • NAM Open Q&A