2 # make sure we can collect web log data
4 template: last_collected_secs
5 on: web_log.response_codes
7 calc: $now - $last_collected_t
10 warn: $this > (($status >= $WARNING) ? ($update_every) : ( 5 * $update_every))
11 crit: $this > (($status == $CRITICAL) ? ($update_every) : (60 * $update_every))
12 delay: down 5m multiplier 1.5 max 1h
13 info: number of seconds since the last successful data collection
17 # -----------------------------------------------------------------------------
18 # high level response code alarms
20 # the following alarms trigger only when there are enough data.
21 # we assume there are enough data when:
25 # i.e. when there are at least 120 requests during the last minute
28 on: web_log.response_statuses
30 lookup: sum -1m unaligned
31 calc: ($this == 0)?(1):($this)
34 info: the sum of all HTTP requests over the last minute
36 template: 1m_successful
37 on: web_log.response_statuses
39 lookup: sum -1m unaligned of successful_requests
40 calc: $this * 100 / $1m_requests
43 warn: ($1m_requests > 120) ? ($this < (($status >= $WARNING ) ? ( 95 ) : ( 85 )) ) : ( 0 )
44 crit: ($1m_requests > 120) ? ($this < (($status == $CRITICAL) ? ( 85 ) : ( 75 )) ) : ( 0 )
45 delay: up 2m down 15m multiplier 1.5 max 1h
46 info: the ratio of successful HTTP responses (1xx, 2xx, 304) over the last minute
49 template: 1m_redirects
50 on: web_log.response_statuses
52 lookup: sum -1m unaligned of redirects
53 calc: $this * 100 / $1m_requests
56 warn: ($1m_requests > 120) ? ($this > (($status >= $WARNING ) ? ( 1 ) : ( 20 )) ) : ( 0 )
57 crit: ($1m_requests > 120) ? ($this > (($status == $CRITICAL) ? ( 20 ) : ( 30 )) ) : ( 0 )
58 delay: up 2m down 15m multiplier 1.5 max 1h
59 info: the ratio of HTTP redirects (3xx except 304) over the last minute
62 template: 1m_bad_requests
63 on: web_log.response_statuses
65 lookup: sum -1m unaligned of bad_requests
66 calc: $this * 100 / $1m_requests
69 warn: ($1m_requests > 120) ? ($this > (($status >= $WARNING) ? ( 10 ) : ( 30 )) ) : ( 0 )
70 crit: ($1m_requests > 120) ? ($this > (($status == $CRITICAL) ? ( 30 ) : ( 50 )) ) : ( 0 )
71 delay: up 2m down 15m multiplier 1.5 max 1h
72 info: the ratio of HTTP bad requests (4xx) over the last minute
75 template: 1m_internal_errors
76 on: web_log.response_statuses
78 lookup: sum -1m unaligned of server_errors
79 calc: $this * 100 / $1m_requests
82 warn: ($1m_requests > 120) ? ($this > (($status >= $WARNING) ? ( 1 ) : ( 2 )) ) : ( 0 )
83 crit: ($1m_requests > 120) ? ($this > (($status == $CRITICAL) ? ( 2 ) : ( 5 )) ) : ( 0 )
84 delay: up 2m down 15m multiplier 1.5 max 1h
85 info: the ratio of HTTP internal server errors (5xx), over the last minute
89 # -----------------------------------------------------------------------------
92 # the following alarms trigger only when there are enough data.
93 # we assume there are enough data when:
97 # i.e. when there are at least 120 requests during the last minute
99 template: 10m_response_time
100 on: web_log.response_time
102 lookup: average -10m unaligned of avg
105 info: the average time to respond to HTTP requests, over the last 10 minutes
108 on: web_log.response_time
110 lookup: average -1m unaligned of avg
115 warn: ($1m_requests > 120) ? ($this > $green && $this > ($10m_response_time * 2) ) : ( 0 )
116 crit: ($1m_requests > 120) ? ($this > $red && $this > ($10m_response_time * 4) ) : ( 0 )
117 delay: down 15m multiplier 1.5 max 1h
118 info: the average time to respond to HTTP requests, over the last 1 minute
121 # -----------------------------------------------------------------------------
122 # web too many or too few requests
124 # the following alarms trigger only when there are enough data.
125 # we assume there are enough data when:
127 # $5m_successful_old > 120
129 # i.e. when there were at least 120 requests during the 5 minutes starting
130 # at -10m and ending at -5m
132 template: 5m_successful_old
133 on: web_log.response_statuses
135 lookup: average -5m at -5m unaligned of successful_requests
138 info: average rate of successful HTTP requests over the last 5 minutes
140 template: 5m_successful
141 on: web_log.response_statuses
143 lookup: average -5m unaligned of successful_requests
146 info: average successful HTTP requests over the last 5 minutes
148 template: 5m_requests_ratio
149 on: web_log.response_codes
151 calc: ($5m_successful_old > 0)?($5m_successful * 100 / $5m_successful_old):(100)
154 warn: ($5m_successful_old > 120) ? ($this > 200 OR $this < 50) : (0)
155 crit: ($5m_successful_old > 120) ? ($this > 400 OR $this < 25) : (0)
156 delay: down 15m multiplier 1.5 max 1h
157 options: no-clear-notification
158 info: the percentage of successful web requests over the last 5 minutes, \
159 compared with the previous 5 minutes