Hey
I can not quite understand the "percentile" trigger.
I would like to use it in the following case.
There is a template that contains item that checks the used ram memory. I would like to achieve a universal trigger that will be triggered for hosts connected to this template.
The problem is that one host returns a value of 30 for this item, and the other host has a value of 700 and this is the correct operation.
I wanted to create a trigger, which checks the last value, compares it with the value taken an hour ago, and if the difference between values is greater than 25% then the alarm is triggered.
This is followed by recovery of the alarm (recovery Expression): compare the last value with the value from the previous day, if the difference is less than 15%, cancel the alarm.
Example data:
Trigger:
Problem expression: prcentile(#1,1h,25.0000)}
Recovery expression: percentile(#1,1d,15.0000)}
At 8 o'clock the trigger compares the value from 7 o'clock. It notices an increase of 50% and triggers an alarm.
At the same time, it compares the value from the previous day at 8 and notes that the increase is below 15% until the previous day - the alarm is turned off. So he should not free himself at all.
However, if the value on the previous day at 8 am will differ by more than 15%, the alarm will be turned on
Maybe it is not a perfect solution but it gives information that something unusual is happening.
Repeated increases in use are normal and therefore want to compare the value with the previous one.
Is my intention to achieve?
Can you do it in a different way? however, I would like to maintain the universality of not configuring the detectors separately for each host.
I wanted to use the recovery expression to let the triggered alarm not go off if the host works with an elevated resource for an hour and the item after checking will notice that the current value is not higher from that one hour ago and will turn off the alarm. (the host further returns values above the correct work but the alarm does not inform about it)
If someone has a different idea to solve the problem I would like to hear it
I can not quite understand the "percentile" trigger.
I would like to use it in the following case.
There is a template that contains item that checks the used ram memory. I would like to achieve a universal trigger that will be triggered for hosts connected to this template.
The problem is that one host returns a value of 30 for this item, and the other host has a value of 700 and this is the correct operation.
I wanted to create a trigger, which checks the last value, compares it with the value taken an hour ago, and if the difference between values is greater than 25% then the alarm is triggered.
This is followed by recovery of the alarm (recovery Expression): compare the last value with the value from the previous day, if the difference is less than 15%, cancel the alarm.
Example data:
| Time | HOSTA |
| 02/08/2019 08:00 | 150 |
| 02/08/2019 07:00 | 100 |
| 02/07/2019 08:00 | 148 |
| 02/07/2019 07:00 | 100 |
Problem expression: prcentile(#1,1h,25.0000)}
Recovery expression: percentile(#1,1d,15.0000)}
At 8 o'clock the trigger compares the value from 7 o'clock. It notices an increase of 50% and triggers an alarm.
At the same time, it compares the value from the previous day at 8 and notes that the increase is below 15% until the previous day - the alarm is turned off. So he should not free himself at all.
However, if the value on the previous day at 8 am will differ by more than 15%, the alarm will be turned on
Maybe it is not a perfect solution but it gives information that something unusual is happening.
Repeated increases in use are normal and therefore want to compare the value with the previous one.
Is my intention to achieve?
Can you do it in a different way? however, I would like to maintain the universality of not configuring the detectors separately for each host.
I wanted to use the recovery expression to let the triggered alarm not go off if the host works with an elevated resource for an hour and the item after checking will notice that the current value is not higher from that one hour ago and will turn off the alarm. (the host further returns values above the correct work but the alarm does not inform about it)
If someone has a different idea to solve the problem I would like to hear it