Variable Triggers

Top  Previous  Next

A variable trigger may raises the alert:

When a variable value satisfies some condition, or
When a variable value changes (no matter to what value)

Selection between these two methods is performed by the Monitor State Changes property of the trigger. Other properties of the variable trigger are described here.

Every variable trigger periodically inspects the value of the variable in every context matching the defined by the Context Mask setting. Polling period is defined in seconds, by the Check Period parameter. A Data Table containing the value of the variable is retrieved from the context, and then something happens, according to the Monitor State Changes setting:

If Monitor State Changes is disabled, the server evaluates the expression defined by the Expression setting. This expression must evaluate to a Boolean result in this case. It may contain references to the cells of the Data Table containing the variable value, but may also refer other variables and functions of AggreGate Server contexts. If the expression evaluates to TRUE and the result of the previous evaluation was FALSE (or if this is the first time the variable is inspected since AggreGate Server was started or since the properties for this alert were last changed), the trigger fires and raises an alert. If the evaluation is TRUE and was also TRUE during the last check, no action is performed. If it changes from TRUE to FALSE, no action it performed either, but subsequent change back to TRUE will fire the trigger.
If Monitor State Changes is enabled, the Expression is evaluated every Check Period exactly like in the previous scenario, but its result may be of any type. The server will remember the last evaluation result. If the new evaluation result is different than the last one, the trigger fires and raises the alert.

If the Context Mask parameter points to more than one context, each context is separately inspected, and the alert is raised every time the variable value satisfies the condition (or changes, depending on the Monitor State Changes setting) in any of these contexts.

note_example-wt

Example of variable trigger without "monitor state changes":

Let's say we're monitoring the Current Temperature variable, coming from a temperature sensor. In this case, Expression may refer to the Celsius Temperature field of this variable and cause a trigger to fire if the temperature exceeds a certain limit.

The trigger parameters may be:

Context Mask

users.user123.devices.temperature_sensor (This mask matches a single Data Terminal context)

Variable

currentTemperature

Expression

{celsiusTemperature} > 100

Monitor State Changes

disabled

Check Period (seconds)

10

Delay (seconds)

0

Alert Level

Warning

note_example-wt

Example of variable trigger with "monitor state changes":

Now let's say we're monitoring a Warning List variable, coming from a piece of medical equipment monitoring several critical parameters of a patient. The value of this variable is a Data Table with up to five records, and every record has a single String field called Warning, containing a textual warning about the state of patient. In this scenario, the Expression may aggregate all warning messages by appending them to each other, and activate the alert when any of the warnings is removed, added or changed.

The parameters of may look like this:

Context Mask

users.user123.deviceservers.medical12.devices.monitor1 (This mask matches to a single Data Terminal context)

Variable

warningList

Expression

{warning[0]} + {warning[1]} + {warning[2]} + {warning[3]} + {warning[4]}

Monitor State Changes

enabled

Check Period (seconds)

100

Alert Level

Warning

Delays and Hysteresis

Variable triggers have a Delay parameter that help to set up alerts like "Warning, temperature is less than 10 degrees for over one hour".

The Delay parameter is relevant only when Monitor State Changes is off. It defines the interval between time when the trigger expression becomes true and the time the alert is raised. If set to zero (the default), the alert is raised immediately when Expression evaluates to TRUE. When Delay is non-zero, the server waits for the specified number of seconds before activating trigger and raising and alert. If Expression evaluates back to FALSE before the Delay time expires, the alert is not raised and the time counter is reset.

note_further-wt

Regardless to the Delay value, trigger expression is re-evaluated only once per Check Period (which is one of the parameters of the trigger - see above). For example, if Check Period is 10 seconds and Delay is 15 seconds alert will be raised 20 seconds after the time when expression has been first evaluated to true.

Variable trigger is activated if Expression is TRUE for longer than Delay time. It is deactivated if:

Deactivator expression is not specified, and Expression is FALSE for longer than Deactivation Delay
Deactivator expression is specified, and it is TRUE for longer than Deactivation Delay. If you think the Deactivator expression seems very similar to the Correlator expression mentioned above, that's because it is! The main difference is that a Correlator expression may lower the alert upon Correlated Event only, while a Deactivator expression is evaluated periodically.

note_further-wt

An activated trigger switches its related alert to Active state and adds an Active Instance.

A combination of Delay and Deactivation Delay is called hysteresis.

note_glossary-term

Hysteresis is the lagging of an effect behind its cause.

The following picture shows how the variable trigger is activated/deactivated when Deactivator is not specified:

 

ls_alerts_trigger_one_expression

 

When Deactivator is specified, activation/deactivation of trigger is performed according to the following picture:

 

ls_alerts_trigger_two_expressions

note_example-wt

Example of variable trigger with hysteresis

Let's return to the one of the above examples involving temperature monitoring.

We want to set up a trigger that:

Activates the alert when temperature is higher than 50 degrees for longer than 5 minutes,
Deactivates the alert when it's active and temperature is lower than 35 degrees for longer than 20 minutes.

The trigger parameters may be as follows:

Context Mask

users.user123.devices.temperature_sensor (This mask matches a single Data Terminal context)

Variable

currentTemperature

Expression

{celsiusTemperature} > 50

Monitor State Changes

disabled

Check Period, seconds

10

Delay, seconds

300

Alert Level

Warning

Deactivator

{celsiusTemperature} < 35

Deactivation Delay, seconds

1200

Flapping Detection

Flapping is a situation where trigger Expression changes its result very rapidly — constantly switching between TRUE and FALSE. This can happen for various reasons — for example if the device constantly reboots, its online status will oscillate.

AggreGate can detect that a variable trigger is flapping. It does so by analyzing previous Expression evaluation results, in terms of how many state changes have happened. AggreGate keeps a history of the 101 most recent checks and analyzes changes within that history. If there are no changes from TRUE to FALSE or back in the last 101 state checks (i.e. 100 state changes), the flapping percentage would be 0%. If all checks have different states, the flapping percentage would be 100%.

Flapping detection is controlled by three parameters:

Enable Flapping Detection
Activation Threshold
Deactivation Threshold

The first parameter must be enabled in order to allow flapping alerts. Once it's enabled, the trigger keeps the result of Expression calculation performed in every Check Period and recalculates flapping percentage on every check.

The flapping alert occurs once there are more then 11 checks (10 state changes) in the history and flapping percentage exceeds Activation Threshold. Flapping alert is processed and delivered like any other alert, its only difference is its cause and alert data. The latter provides information about flapping percentage that caused the alert.

The trigger will remain in Flapping Detected state until current flapping percentage drops below Deactivation Threshold.

Flapping and Trigger Activation

Flapping and normal trigger activation are fully independent. This means that a trigger may be in Active and Flapping Detected states simultaneously. This also means that normal alert and flapping alert may be raised by the trigger in any order.

Flapping detection will not cause normal activation that occurs when Expression result remains TRUE for longer than Delay.

Resolution Environment

Variable Trigger Expression and Deactivator Expression Resolution Environment:

Default Context

None.

Default Data Table

Current value of the trigger's variable.

Default Row

0

Environment Variables

Standard variables only.