Coralogix’s ‘Time Relative’ alert is triggered when the ratio reaches a set threshold compared to the past time frame.
In many use cases, this alert enables you to detect a possible abnormal behavior within your system, automatically. A few examples of how to utilize ratio alerts:
Operations:
Alert will be triggered when there are more errors than yesterday. Now comparing error rates between days can be done automatically.
Alert will be triggered when there are more delays in page load time than last hour. Many web applications have page load time fields and now it is possible to be automatically informed about issues with page loading.
Security:
Alert will be triggered when there are more NX domain name responses than last week.
Alert will be triggered when there are more than 3x admin logins than yesterday.
The ‘Time Relative’ alert can do the comparison of suspected behaviors for you. It allows you to focus only on dangerous issues.
Business:
Alert will be triggered when there is less purchased than the same day last week
Alert will be triggered when there are fewer new user signups than last month
The ‘Time Relative’ alert can notify about trends changes earlier. No need to monitor it every day.
1. Go to the Alerts tab, open a new alert, and name it. Then, select the ‘Time Relative’ alert type.
2. Enter a query that will identify the subsets of logs that will be tracked.
3. Set up the conditions. The condition supports either ‘more’ or ‘less’ than, for the ratio chosen in the Query now to the same query but from the time defined after compared to.
The ratio is Q1 (is the current status)/Q2 (is the history).
For example:
The query returns for the last hour 180 error logs. The same query but in a different timeframe (e.g Previous hour) returns 60 error logs. It means the ratio is 3. If the ratio is More than 1 then the alert will be triggered as the threshold was reached.
Choose the timeframe and the time to compare to:
4. The rest of the alert settings doesn’t change from the standard alert setup.
5. The final step is to click on the ‘Create alert’ button on the upper-right side of the screen. You’re all set!
Note: The alert is silenced for the time it is set 1Hour/Day/Week/Month from the time when it was created:
The comparison is performed depending on the condition:
Once triggered, the alert will display the count of logs for the current timeframe, for the compared timeframe, and the quotient of both.
Enjoy and take advantage of this great alerting capability.
Like always if you have any questions or suggestions, please contact us in the in-app chat or send us an email at [email protected].