Alerting Manual

Alert types and scenarios

There are a few alert types that you can use. Each type works differently with a search to trigger alert actions. You can choose an alert type depending on what event you are tracking and when you want to know about it. You can also throttle an alert if you want to change its frequency.

Here are some scenarios for using each type of alert. To learn how to throttle an alert, see Throttle alerts and related searches.

Per result alert

Use a per result alert to notify when a real-time search returns a result that matches a condition. Typically, you specify a throttle condition so that the alert triggers only once for a specified time period.

Per result examples include the following:

• Trigger an alert for every failed login attempt.

• Trigger an alert when a specific type of error occurs on any host.
  You can choose field values that suppress hosts for which you do not want an alert notification.

• Trigger an alert when a CPU on a host sustains 100% utilization for an extended period of time.

Caution: Be careful using a per result alert in a high availability deployment. If a peer is not available, a real-time search does not warn that the search might be incomplete. Use a scheduled alert for this scenario.

Scheduled alert

Use a scheduled alert to notify when a scheduled search returns results that meet a specific condition. A scheduled alert is useful when an immediate reaction to the alert is not a priority. Scheduled alert examples include:

• Trigger an alert that runs daily, notifying when the number of items sold that day is less than 500.

• Trigger an alert that runs hourly, notifying when the number of 404 errors in any hour exceeds 100.

Rolling-window alert

Use a rolling window alert to monitor the results of a real-time search within a specified time interval. For example, monitor the results every 10 minutes or every four hours. Rolling-window alert examples include:

• Trigger an alert when a user has three consecutive failed logins within a 10 minute period.
  You can set a throttle condition to suppress an alert to once an hour from any user.

• Trigger an alert when a host is unable to complete an hourly file transfer to another host.
  Set a throttle condition so the alert fires only once every hour for any specific host.

Caution: Be careful using a real-time search in a high availability deployment. If a peer is not available, a real-time search does not warn that the search might be incomplete. Use a scheduled alert for this scenario.