Filter your alerts

How do I include or exclude certain members of a group of resources covered by any given alert? By adding filters to your alerts of course!

You can include a parameter in your alert definitions in etc/alert.*.cfg specifying a filter. This allows you to add a bit of secondary logic before an alert is sent to the portal. This is useful for alerts on collections of metrics -- like table & index stats, storage areas, or app servers where there is a group of things but you want to alert differently based on the name of an instance of the thing.

Sample alert filter syntax (the last three components of this definition:

tblRd num > 5000 "" "hourly" "&1 &2 &3" alert tblName = "product"

fsPctUsed num > 30 "" 60 "Disk space % &1 &2 &3" page tt_diskFree.mnt inlist "SC-Data2,SC-OS,82C1F6B1"

Format:

This is a space-delimited set of three fields added to the definition after the Action list:

1. [temptable name.] fieldName - an Alertable Metric from the same Data Collector as the Alertable Metric at the start of the alert definition. In the example above, tblRd and tblName are both from the Table Activity Data Collector (tt_tblAct); the current record's field value is the value used.
   
   NOTE: as a best practice, include the temptable name in the filter definition, as seen in the second example above. Temptable names are found in the first row of the table on each data collector detail page. Doing so will facilitate the ability to filter on more than one metric from more than one temp table in the future.
2. operator - see Rule 4. below
3. "targetValue" - a double-quoted string of one or more (comma-delimited) strings. Important if any of the strings include spaces.

Rules:

1. The set is placed after the alert actions string (just 'alert' in this case)
2. The filter is an AND condition -- if the filter is true, then the alert threshold is met; otherwise, it fails
3. Only character comparisons are available
4. The usual =, >, <, <>, >=, <= operators are supported, plus the following:

• • inlist -- equivalent to lookup( X, targetValues ) where X is the current value of the field and the targetValues are a comma delimited string (e.g. _File,_Field)

  • !inlist -- not( inlist )

  • begins -- X begins targetValue (e.g. _Fi)

  • !begin -- not( X begins targetValue ) note: there is no "s", that is deliberate, read as "does not begin"

  • matches -- X matches targetValue (e.g. "tblName matches _Fi*"; note the asterisk)

  • !match -- not( X matches targetValue ) note: there is no "es", that is also deliberate, read as "does not match"

  • longer -- X has more characters than targetValue (a number, e.g. "tblName longer 5")

  • shorter -- X has fewer characters than targetValue (a number, e.g. "tblName shorter 6")

NOTE: These comparison operators are also available for the initial alert comparison.

See also:

Alert Configuration

Disk space monitoring