| 1 | |
| 2 | # unmatched lines |
| 3 | |
| 4 | # the following alarms trigger only when there are enough data. |
| 5 | # we assume there are enough data when: |
| 6 | # |
| 7 | # $1m_total_requests > 120 |
| 8 | # |
| 9 | # i.e. when there are at least 120 requests during the last minute |
| 10 | |
| 11 | template: web_log_1m_total_requests |
| 12 | on: web_log.requests |
| 13 | class: Workload |
| 14 | type: Web Server |
| 15 | component: Web log |
| 16 | lookup: sum -1m unaligned |
| 17 | calc: ($this == 0)?(1):($this) |
| 18 | units: requests |
| 19 | every: 10s |
| 20 | info: number of HTTP requests in the last minute |
| 21 | |
| 22 | template: web_log_1m_unmatched |
| 23 | on: web_log.excluded_requests |
| 24 | class: Errors |
| 25 | type: Web Server |
| 26 | component: Web log |
| 27 | lookup: sum -1m unaligned of unmatched |
| 28 | calc: $this * 100 / $web_log_1m_total_requests |
| 29 | units: % |
| 30 | every: 10s |
| 31 | warn: ($web_log_1m_total_requests > 120) ? ($this > 1) : ( 0 ) |
| 32 | delay: up 1m down 5m multiplier 1.5 max 1h |
| 33 | summary: Web log unparsed |
| 34 | info: Percentage of unparsed log lines over the last minute |
| 35 | to: webmaster |
| 36 | |
| 37 | # ----------------------------------------------------------------------------- |
| 38 | # high level response code alarms |
| 39 | |
| 40 | # the following alarms trigger only when there are enough data. |
| 41 | # we assume there are enough data when: |
| 42 | # |
| 43 | # $1m_requests > 120 |
| 44 | # |
| 45 | # i.e. when there are at least 120 requests during the last minute |
| 46 | |
| 47 | template: web_log_1m_requests |
| 48 | on: web_log.type_requests |
| 49 | class: Workload |
| 50 | type: Web Server |
| 51 | component: Web log |
| 52 | lookup: sum -1m unaligned |
| 53 | calc: ($this == 0)?(1):($this) |
| 54 | units: requests |
| 55 | every: 10s |
| 56 | info: number of HTTP requests in the last minute |
| 57 | |
| 58 | template: web_log_1m_successful |
| 59 | on: web_log.type_requests |
| 60 | class: Workload |
| 61 | type: Web Server |
| 62 | component: Web log |
| 63 | lookup: sum -1m unaligned of success |
| 64 | calc: $this * 100 / $web_log_1m_requests |
| 65 | units: % |
| 66 | every: 10s |
| 67 | warn: ($web_log_1m_requests > 120) ? ($this < (($status >= $WARNING ) ? ( 95 ) : ( 85 )) ) : ( 0 ) |
| 68 | crit: ($web_log_1m_requests > 120) ? ($this < (($status == $CRITICAL) ? ( 85 ) : ( 75 )) ) : ( 0 ) |
| 69 | delay: up 2m down 15m multiplier 1.5 max 1h |
| 70 | summary: Web log successful |
| 71 | info: Ratio of successful HTTP requests over the last minute (1xx, 2xx, 304, 401, 429) |
| 72 | to: webmaster |
| 73 | |
| 74 | template: web_log_1m_redirects |
| 75 | on: web_log.type_requests |
| 76 | class: Workload |
| 77 | type: Web Server |
| 78 | component: Web log |
| 79 | lookup: sum -1m unaligned of redirect |
| 80 | calc: $this * 100 / $web_log_1m_requests |
| 81 | units: % |
| 82 | every: 10s |
| 83 | warn: ($web_log_1m_requests > 120) ? ($this > (($status >= $WARNING ) ? ( 1 ) : ( 20 )) ) : ( 0 ) |
| 84 | delay: up 2m down 15m multiplier 1.5 max 1h |
| 85 | summary: Web log redirects |
| 86 | info: Ratio of redirection HTTP requests over the last minute (3xx except 304) |
| 87 | to: webmaster |
| 88 | |
| 89 | template: web_log_1m_bad_requests |
| 90 | on: web_log.type_requests |
| 91 | class: Errors |
| 92 | type: Web Server |
| 93 | component: Web log |
| 94 | lookup: sum -1m unaligned of bad |
| 95 | calc: $this * 100 / $web_log_1m_requests |
| 96 | units: % |
| 97 | every: 10s |
| 98 | warn: ($web_log_1m_requests > 120) ? ($this > (($status >= $WARNING) ? ( 10 ) : ( 30 )) ) : ( 0 ) |
| 99 | delay: up 2m down 15m multiplier 1.5 max 1h |
| 100 | summary: Web log bad requests |
| 101 | info: Ratio of client error HTTP requests over the last minute (4xx except 401 and 429) |
| 102 | to: webmaster |
| 103 | |
| 104 | template: web_log_1m_internal_errors |
| 105 | on: web_log.type_requests |
| 106 | class: Errors |
| 107 | type: Web Server |
| 108 | component: Web log |
| 109 | lookup: sum -1m unaligned of error |
| 110 | calc: $this * 100 / $web_log_1m_requests |
| 111 | units: % |
| 112 | every: 10s |
| 113 | warn: ($web_log_1m_requests > 120) ? ($this > (($status >= $WARNING) ? ( 1 ) : ( 2 )) ) : ( 0 ) |
| 114 | crit: ($web_log_1m_requests > 120) ? ($this > (($status == $CRITICAL) ? ( 2 ) : ( 5 )) ) : ( 0 ) |
| 115 | delay: up 2m down 15m multiplier 1.5 max 1h |
| 116 | summary: Web log server errors |
| 117 | info: Ratio of server error HTTP requests over the last minute (5xx) |
| 118 | to: webmaster |
| 119 | |
| 120 | # ----------------------------------------------------------------------------- |
| 121 | # web slow |
| 122 | |
| 123 | # the following alarms trigger only when there are enough data. |
| 124 | # we assume there are enough data when: |
| 125 | # |
| 126 | # $1m_requests > 120 |
| 127 | # |
| 128 | # i.e. when there are at least 120 requests during the last minute |
| 129 | |
| 130 | template: web_log_10m_response_time |
| 131 | on: web_log.request_processing_time |
| 132 | class: Latency |
| 133 | type: System |
| 134 | component: Web log |
| 135 | lookup: average -10m unaligned of avg |
| 136 | units: ms |
| 137 | every: 30s |
| 138 | info: average HTTP response time over the last 10 minutes |
| 139 | |
| 140 | template: web_log_web_slow |
| 141 | on: web_log.request_processing_time |
| 142 | class: Latency |
| 143 | type: Web Server |
| 144 | component: Web log |
| 145 | lookup: average -1m unaligned of avg |
| 146 | units: ms |
| 147 | every: 10s |
| 148 | green: 500 |
| 149 | red: 1000 |
| 150 | warn: ($web_log_1m_requests > 120) ? ($this > $green && $this > ($web_log_10m_response_time * 2) ) : ( 0 ) |
| 151 | crit: ($web_log_1m_requests > 120) ? ($this > $red && $this > ($web_log_10m_response_time * 4) ) : ( 0 ) |
| 152 | delay: down 15m multiplier 1.5 max 1h |
| 153 | summary: Web log processing time |
| 154 | info: Average HTTP response time over the last 1 minute |
| 155 | options: no-clear-notification |
| 156 | to: webmaster |
| 157 | |
| 158 | # ----------------------------------------------------------------------------- |
| 159 | # web too many or too few requests |
| 160 | |
| 161 | # the following alarms trigger only when there are enough data. |
| 162 | # we assume there are enough data when: |
| 163 | # |
| 164 | # $5m_successful_old > 120 |
| 165 | # |
| 166 | # i.e. when there were at least 120 requests during the 5 minutes starting |
| 167 | # at -10m and ending at -5m |
| 168 | |
| 169 | template: web_log_5m_successful_old |
| 170 | on: web_log.type_requests |
| 171 | class: Workload |
| 172 | type: Web Server |
| 173 | component: Web log |
| 174 | lookup: average -5m at -5m unaligned of success |
| 175 | units: requests/s |
| 176 | every: 30s |
| 177 | info: average number of successful HTTP requests for the 5 minutes starting 10 minutes ago |
| 178 | |
| 179 | template: web_log_5m_successful |
| 180 | on: web_log.type_requests |
| 181 | class: Workload |
| 182 | type: Web Server |
| 183 | component: Web log |
| 184 | lookup: average -5m unaligned of success |
| 185 | units: requests/s |
| 186 | every: 30s |
| 187 | info: average number of successful HTTP requests over the last 5 minutes |
| 188 | |
| 189 | template: web_log_5m_requests_ratio |
| 190 | on: web_log.type_requests |
| 191 | class: Workload |
| 192 | type: Web Server |
| 193 | component: Web log |
| 194 | calc: ($web_log_5m_successful_old > 0)?($web_log_5m_successful * 100 / $web_log_5m_successful_old):(100) |
| 195 | units: % |
| 196 | every: 30s |
| 197 | warn: ($web_log_5m_successful_old > 120) ? ($this > 200 OR $this < 50) : (0) |
| 198 | crit: ($web_log_5m_successful_old > 120) ? ($this > 400 OR $this < 25) : (0) |
| 199 | delay: down 15m multiplier 1.5 max 1h |
| 200 | options: no-clear-notification |
| 201 | summary: Web log 5 minutes requests ratio |
| 202 | info: Ratio of successful HTTP requests over over the last 5 minutes, \ |
| 203 | compared with the previous 5 minutes \ |
| 204 | (clear notification for this alarm will not be sent) |
| 205 | to: webmaster |