Log Alerting - allow grouping criteria for basic alerts
Summary: In the discussion initiated by Matt Whitney, a problem regarding log alerting conditions is presented. Currently, only stateful log alert conditions support using grouping criteria, whereas basic log conditions do not, except for the default resource-level grouping. This limitation prevents users from using the "alert after X matching logs" feature in conjunction with grouping criteria, thus affecting use cases like interface-level log/trap alerts. Suzanne Shaw tags another user, Patrick Sites, seeking further insights into the issue.
Currently only stateful log alert conditions support using a grouping criteria. Basic log conditions do not support using any kind of grouping criteria except for the default resource-level grouping.
Only basic alert conditions support alerting after X amount of matching logs within a certain time window.
This means that if I have a use case where I only want to alert after X amount of matching logs within a certain time period, then I cannot use grouping criteria. So interface-level log/trap alerts for example could not take advantage of the "alert after X matching logs" feature.
We have a use case where we are getting traps for interface-level problems. But it is not possible to both group alerts by interface, and only alert after X matching logs. I have to choose one or the other, which means LM can't help us with our use case at this time.
Patrick Sites
·3 months agoThis was actually on our radar for research in Q2 with the intent of evaluating it for roadmap placement in Q3. We still believe it's a valuable enhancement and the use cases make sense. However, as we've gone through planning and resource allocation, we've had to shift engineering focus toward higher-priority Envision integration work. As a result, this item research has been deprioritized for now and moved back into the backlog. We'll revisit it during the next planning cycle and reassess where it fits alongside other priorities.
Suzanne Shaw
Admin3 months ago@Patrick Sites Do you have any insights here?