Alert Rule Syntax

Question

Hi,Because LM uses Text-based matching, I know it’s picky about how you configure alert rules with regards to /s and *s in the Group field.&nbsp; I just want to make sure I understand this right.&nbsp; I pulled a list of every alert we’ve gotten for the last year, and compared that to our list of Alert Rules, and found some problems.&nbsp; I noticed we have some things setup incorrectly in our portal and we might be missing alerts.Scenario: Let’s say I have a group called Production Servers.&nbsp; Inside that group I have groups for Web Servers, App Servers, and Database Servers.&nbsp; Let’s also say each of those sub groups have other sub-groups inside of them.&nbsp; Each of the groups has servers in them.If I have an alert rule set with group “Production Servers”, will that find servers that are in the Production Servers group but not in the sub groups?	If I have an alert rule set with group “Production Servers*”, will that find servers that are in the Production Servers group AND in any of the sub groups?	If I have an alert rule set with group “Production Servers/*”, will that only find servers that are in the sub groups, but not servers that are in Production Servers?Are there any other variations on that I should keep in mind?Thanks!

amr · Answer

Your understanding is correct. It’s the same as the first 3 examples in the Glob Expressions examples in the table below:
https://www.logicmonitor.com/support/terminology-syntax/glob-expressions#:~:text=Production/!(Network/Servers)-,Specifying%20Groups%20with%20Glob%20Expressions,-Resource%20groups%20can
Since the group field supports the use of Glob expressions, it helps with covering many use cases around Alert Rule inclusion/exclusion of groups, some examples are listed in the above article as well

kelemvor · Answer

Thanks.&nbsp; I’ll take a look.

amr · Answer

Sounds good, happy to help with glob expressions&nbsp;if there’s a use case that you’d like to cover within alert rules.&nbsp;Feel free to submit a support ticket if you’d like a support engineer to take a look at examples on your portal, if needed&nbsp;🙇

Forum Discussion

Alert Rule Syntax

Related Content

Complex datapoint expression syntax

Is there a way to configure an Alert Rule to only match websites OR resources?

SNMP Traps - Baseline for alerting

Bug Report: Editing Alert Rules broken

Can the API get the alert rule associated to a datapoint on a DS instance?

Recent Discussions

SNMP Traps - Baseline for alerting

Elasticsearch and OpenSearch

Devops metrics monitoring in Lm

LM APM - Traces - HTTP Post from Powershell Scripts

Module Toolbox AppliesTo IDE