Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Better a few complicated rules or more simple rules (What is the best practice?)

bsciencefiction.tv

For example,

Is it better to have say three hard drive rules that are simple like

Rule 1

If Server is Windows and Caption is C:\ and Volume space free is less than 10%

Rule 2

If Server is Windows and Caption is \ and Volume space free is less than 15%

Rule 3

If Server is Windows and Caption is E:\ andVolume space free is less than 20%

Or is it better to have 1 rule that say

Rule 1

If Server is Windows,

And

Caption is C:\, and Volume space free is less than 10%

Caption is \, and Volume space free is less than 15%

Caption is E:\, and Volume space free is less than 20%

Find more posts tagged with

Accepted answers

RichardLetts

I didn't write the code, You can find the evaluation process yourself -- turn up the logging on the alert process and read the logfiles.

You have to stop thinking about alerts, and think about Venn diagrams:

you have the 'alert triggered tab', this is a SQL query that returns the set of things (A)

you have the 'alert reset tab', this is a SQL query that returns the set of things (R)

The Alert manager then

1. generate alerts for things that are members of A but not R

2. resets alerts for things that are members of R (that were previously in A alone)

3. DOES NOTHING for things that are members of A and R

You can also copy one of your existing rules and convert it into a custom SQL -- the UI will expose the underlying query. You can then paste the SQL into the MS-SQL workbench and get a plan execution cost for the query; I would expect the costs to be less than 1 for anything you can pick form menus in the alert manager UI.

To answer the original question (B) one complicated rule probably uses less total resources than three rules, but not significantly so.

[aside: a thing is something you can alert on: an interface, volume, BGP peer, custom poller, and of course a node]

All comments

rhidians

Personally I like the more complicated option of the 2 you have there. A bit harder to think about first but the upside is you have less maintenance. (As in editing 1 rule as oppose to editing 3)

wbrown

I'd say it depends on what you're trying to alert on.

"Free space issue on drive X"

"Server A has drive space issue"

I'm curious what the performance difference would be on the polling and DB servers. Does either of those methods create a greater workload?

Another possibility would be to add a custom property to the drives. The property would be the alert threshold. This would only require a single rule to implement. Again, I'm curious what the performance difference would be.

bsciencefiction.tv

, that is exactly what is driving my question, is one way or the other better for performance.

ouberlord

For better or worse, we've chosen the route that wbrown mentioned and use custom properties. It basically boils down to:

If VolumeWarningCustomProperty is not null

If Used Space is greater than VolumeWarningCustomProperty then alert

Else

If Used Space is greater than 85% then alert

We haven't seen any performance issues doing this, but we only have a few hundred nodes. Still, I would assume that having it in one alert ruleset is probably more efficient than making it check multiple ones, but that's pretty much baseless speculation on my part.

This also means that you can just set the property on each volume to whatever percentage you deem to warrant a warning at individually from other volumes on the node / volumes in general. If left blank, it just defaults to warning once the drive gets above 85% (or whatever you want) capacity used.

wbrown

Any devs out there that can answer these questions or give insight to the expression evaluation process?

Does the entire ruleset get evaluated before the trigger/no-trigger decision is made?

Is short-circuit evaluation used? (as soon as first trigger condition is met then is any further evaluation performed?)

Are all the DB lookups done at once or is each DB call performed individually as needed during rule processing?

Can it be confirmed or refuted that each additional rule adds additional overhead?

bsciencefiction.tv

Do I understand what you are saying is that you put the alert level in the custom property id 35 % or 10 GB and it does the less than evaluation off of the custom property?

ouberlord

Essentially yes, though the custom property must only contain a percentage value (In our case. Yours can differ if you want.) Our actual alert reads like this (Note that "ThresholdDisk" is our custom property for this):

Trigger Alert when all of the following apply

VolumeType is equal to Fixed Disk

Trigger Alert when any of the following apply

Trigger Alert when all of the following apply

ThresholdDisk is empty

Volume Percent Used is greater than or equal to 85

Trigger Alert when all of the following apply

ThresholdDisk is not empty

field Volume Percent Used is greater than or equal to field ThresholdDisk (this is a complex condition, thus the usage of "field")

ouberlord

I'd love to know this as well.

RichardLetts

I didn't write the code, You can find the evaluation process yourself -- turn up the logging on the alert process and read the logfiles.

You have to stop thinking about alerts, and think about Venn diagrams:

you have the 'alert triggered tab', this is a SQL query that returns the set of things (A)

you have the 'alert reset tab', this is a SQL query that returns the set of things (R)

The Alert manager then

1. generate alerts for things that are members of A but not R

2. resets alerts for things that are members of R (that were previously in A alone)

3. DOES NOTHING for things that are members of A and R

To answer the original question (B) one complicated rule probably uses less total resources than three rules, but not significantly so.

[aside: a thing is something you can alert on: an interface, volume, BGP peer, custom poller, and of course a node]