Monitors¶
In Guance, you can use ready-to-use monitoring templates to create monitors by creating a monitor; you can also customize the creation of monitors and set detection rules and trigger conditions through more than ten detection rules such as threshold detection, log detection, change detection and interval detection. After enabling the monitor, you can receive relevant abnormal event alarms triggered by detection rules.
Setup¶
In Guance, you can quickly create monitors from templates such as hosts, Docker, Elasticsearch, or create custom monitors and configure alarms.
Monitors¶
Detection Rules¶
Currently, Guance supports 13 types of monitoring detection rules, covering different data ranges.
| Rule Name | Data Range | Description |
|---|---|---|
| Threshold Detection | All | Detect anomalies in metric data based on set thresholds. |
| Change Detection | Metric(M) | Detect anomalies in metric data based on historical data, suitable for scenarios with short time windows and business data. |
| Interval Detection | Metric(M) | Detect anomalies in metric data points based on dynamic threshold ranges, suitable for stable trend timelines. |
| Outlier Detection | Metric(M) | Detect whether there are outliers in the metric/statistical data of the detected objects under specific groups. |
| Log Detection | Log(L) | Detect anomalies in business applications based on log data. |
| Process Anomaly Detection | Process(O::host_processes) |
Periodically detect process data to understand process exceptions. |
| Infrastructure Active Detection | Object(O) | Monitor the stability of infrastructure based on infrastructure object data and set availability conditions. |
| APM Metric Detection | Trace(T) | Detect anomalies based on application performance monitoring data and set threshold rules. |
| RUM Metric Detection | RUM(R) | Detect anomalies based on RUM data and set threshold rules. |
| Scheck Anomaly Detection | Scheck(S) | Detect anomalies based on data generated by security check, effectively detecting host health status. |
| Testing Anomaly Detection | Synthetic test data(L::type) |
Detect anomalies based on synthetic tests data and set threshold rules. |
| Network Anomaly Detection | Network(N) | Detect anomalies based on network data and set threshold rules to monitor network performance stability. |
| Third-party Event Detection | Others | Generate Guance event data by sending abnormal events or records generated by third-party systems to an HTTP server via a specified URL using the POST request method. |
Templates¶
Guance provides a variety of ready-to-use monitoring templates, which support one-click creation of official monitors such as hosts, Docker, Elasticsearch, Redis, Alibaba Cloud RDS, Alibaba Cloud SLB, and Flink Monitoring to the current workspace.
Note: Repeatedly creating monitors from templates will result in duplicate monitors in the monitor list. Guance supports detecting duplicate monitors. You can choose "Yes" in the pop-up prompt to create all monitors in the template library normally, or choose "No" to create only unique monitors.
Custom Templates¶
You can save created monitors as templates for quick addition or deletion of monitor configuration conditions.
Monitor List¶
In the monitor list, you can view all monitors in the current workspace, including their names, alert policies, creators, etc.
Operations¶
-
Enable/Disable: Guance supports enabling/disabling existing monitors. New monitors will be enabled by default.
- Note: Disabled monitors will no longer take effect; disabled monitors can be re-enabled.
-
Edit: Guance supports re-editing existing monitors by clicking on the monitor name or Edit.
-
Delete: Guance supports deleting existing monitors.
- Note: Once a monitor is deleted, the monitor data cannot be recovered, but event data will still be retained.
-
Batch Operation: You can perform batch operations on specific monitors, including batch enable/disable, delete, and export.
-
View Related Events: All alert events triggered by the same monitor are stored under the corresponding Monitor. By clicking View Related Events, you can directly jump to view all unrecovered events triggered by this rule and perform event management.
-
View Related Views: Each monitor can be associated with a dashboard. By editing the monitor, you can associate the corresponding desired dashboard using the Associate Dashboard feature.
-
Manually Trigger Test: Guance supports manually triggering monitor detection. If the current detection rule is triggered, you can view the relevant details in the event viewer.
- Note: When testing a monitor, as long as it is manually triggered, an event record will be generated and an alert notification will be sent; When manually testing, mute rules still take effect.
Search¶
In the left Filter, you can quickly locate the target monitors based on alert strategies, status, labels and monitor types.
You can also directly search based on monitor names and alert strategy names in the search box.
Import¶
In monitors, you can create monitors by importing monitor configuration JSON files. The imported JSON file will be directly imported as a monitor and grouped by default.
Note: The imported JSON file must be a configuration JSON file from Observability.
Labels¶
Guance supports adding labels to monitors. You can select existing labels or directly enter them manually and press Enter to create new labels. These labels will also be attached to the events triggered by monitor detection.
The added labels will be directly displayed in the list after saving. You can use the Filter > Tags to quickly find the monitors included in the corresponding labels.
Logic description:
The label value format is not limited and can be in the format of value, such as aaa, or key:value, such as test:123;
If the key of a custom label you set is the same as other event attributes, it will be discarded (except for tags). For example, when setting the monitor by host, the event attribute generated will have host:guance_01. If you add the label host:000 to the monitor, the custom label host:000 will be discarded and not written to the event attribute.
SLO¶
Monitors added to SLO as SLI will be displayed with special icons:
Hover to view the associated SLO list, and click to open the corresponding SLO details page.
Alert Strategy¶
Alert Strategy allows you to create meaningful monitor combinations when setting monitors. You can filter corresponding monitors through Alert Policies to facilitate the management of alert policies for various monitors.
Note:
- To ensure that data within the detection time range is not affected by network, storage, and other delays, the monitor's abnormal event detection is configured with a 2-minute wait time;
- Each monitor must select an alert strategy when creating a monitor, and Default is selected by default;
- When a specific alert strategy is deleted, the monitors under the deleted alert strategy will be automatically categorized under Default.
Recover Monitor¶
Guance supports viewing the status, last update time, creation time and creator of existing monitors, and supports viewing historical configurations of monitors by recovering monitors. This helps you communicate and collaborate with other team members to update monitors quickly.
Example:
In Monitoring > Monitors, select and edit an existing monitor. On the monitor configuration page, click the button in the upper right corner to view the monitor's status, last update time, creation time, and creator.
Click the view button next to the Last Updated time in the above figure to open a new browser window and view the previous version of the monitor configuration;
Click Recover This Version in the previous version of the monitor. In the pop-up dialog box, confirm the recovery to revert to the previous version of the monitor configuration for editing and saving.
