Creating Triggers with ControlUp – A Discussion on Using “Super Triggers”

A team member asked if it was possible to create a trigger for logon duration exceeding a certain time. Another member suggested using average logon duration and getting creative with it. They discussed the idea of nested triggers and using "super triggers" as a workaround to count individual instances of logon duration and trigger an alert when a threshold is reached. The team will continue to look into this solution.

Read the entire ‘Creating Triggers with ControlUp – A Discussion on Using "Super Triggers"’ thread below:

Hi question for the team here: is it possible to create a trigger such as "If there are >10 instances of logon duration >75 seconds in 5 minutes" then we trigger an alert?

Hm, I don’t think we can count like that in triggers. You could go with average logon duration on the machine level being above average and maybe get creative with that. @member you have any creative ideas

Gotcha yep it’s almost like we need an enhancement to triggers to be able to nest triggers; e.g. create a trigger based upon an individual instance of logon duration exceeding let’s say 120 secs and then nest that trigger inside another trigger that says if that triggers fires >10x in 5 min (since there are many metrics that if it happens individually is okay but in combo with other metrics is an early warning sign, kind of like when certain weather conditions occur simultaneously then that triggers a tornado warning).

Cc @member @member

great feedback for our current design workshop

We can do this if you’re okay with a workaround. We call them super triggers (and for the CU people reading this, there’s an idea draft in Confluence).

The idea is that we:

• Use individual object triggers. For example in your case you’d set logon duration triggers on individual sessions.

• Those individual triggers don’t alert you or take any formal action. They just run a script that counts how many other ~machines~ sessions are in this state.

• If the threshold of machines in the desired state is hit, write an event log that causes trigger 2 to fire.

• Trigger 2 sends you an alert via email/slack/team, opens a ITSM incident, etc. Your regular follow up action

Alternatively you can do this based on a scheduled trigger. Same concept as above, except the event that causes the evaluation of whether you’ve hit the threshold is time instead of a user logon.

I was thinking about super triggers. It’ll get you there. Not perfect

Hmm okay that is a good thought; thank you … we will look into configuring this and keep this channel in the loop.

Continue reading and comment on the thread ‘Creating Triggers with ControlUp – A Discussion on Using “Super Triggers”‘.  Not a member? Join Here!