Use Year-Over-Year and Month-Over-Month as Alert Trigger Conditions

Introduction

When configuring alarm trigger conditions, be aware that certain services require indicator comparisons. An alarm is triggered if the change exceeds a defined threshold. For instance, if an indicator increases by more than 50% compared to the same period yesterday, an alarm will be activated.

Configuration method

When configuring alarm strategies, fill in the following execution statements and trigger conditions:

Execution statement:

Select the query time range as 1 hour (relative), and then execute the following statement to count the ratio of the number of appearances of ERROR keyword in the log of the current hour and the same period yesterday. For more information about the compare function, please refer to Year-on-year and month-on-month functions.

1error | select
2  compare[1] as today,
3  compare[2] as yesterday,
4  round((compare[3]-1)*100,3) as growth
5from
6  (
7    select compare(cnt, 86400) as compare
8    from
9      (
10        select COUNT(*) as cnt
11      )
12  )

In the execution result of the above statement:

• growth represents the current value growth compared with yesterday (that is 86,400 seconds ago)
• today represents the error statistics of the current query yesterday.
• yesterday represents the error statistics of the same period yesterday.

Trigger conditions:

1$1.growth > 0.5

A "Growth > 0.5" condition means an alarm will be triggered if the appearance of error keywords in the last hour exceeds a 50% growth compared to the same period yesterday.