Monitor Trigger Execution through the humio-activity Repository

The humio/activity package provides a wealth of information about activity within LogScale and should be installed to help monitor triggers.

Examine the category field in the humio-activity repository to track progress and any errors generated when executing triggers.

The status field indicates either a Success or Failure. Repeated entries with a failure indicate an error should be investigated.

The four main success scenarios are:

  • LogScale successfully started the trigger query.

  • LogScale successfully polled the trigger query, found events to trigger on, and successfully triggered at least one of the associated actions

  • LogScale successfully polled the alert query, found events to trigger on, but the alert was throttled (not for scheduled search)

  • LogScale successfully polled the trigger query, but found no events to trigger on

Checking the severity field indicates the level of the event:

  • Info entries are used to indicate when an alert has been triggered or other informational messages. No action is required.

  • Warning indicates an issue either with the alert, reading the result, or triggering actions, or where an alert has not been triggered due to throttling. In some cases, the warning resolves on its own. But if the message persists, it may require action.

  • Error indicates an error, for example running the query or trigger. Requires action.

For information about additional fields each event contains, see Basic Structure. For a full example event, see Trigger Raw Event Example.

Trigger Raw Event Example

An example of a full event showing an error for reference.