Composite Monitor¶
Document Purpose
This document is the second step in the monitor rule configuration process. After completing the configuration, return to the main document to continue with step three: Event Notifications.
Data scope: All (performs logical operations based on the results of the combined monitors)
Combine the results of multiple monitors into a single monitor using an expression, and alert based on the combined result. This is suitable for complex scenarios such as multi-condition joint evaluation and dependency detection.
Detection Configuration¶
Detection Frequency¶
A composite monitor does not have a fixed detection frequency; instead, it evaluates based on the event status of the selected monitors. Because different monitors may have different detection frequencies, the system performs synchronized evaluation using the largest detection frequency among them.
Example: Monitor A has a detection frequency of 5 minutes, and monitor B has a detection frequency of 1 hour. The composite monitor A&&B therefore evaluates in sync with B (once per hour). When B triggers a detection, the system performs a logical evaluation using B's detection result combined with monitor A's latest detection result.
Detection Metrics¶
Select Monitors¶
Select at least two monitors as combination targets. The system automatically assigns identifiers (A, B, C, ...) for later reference in the logical expression.
| Configuration Item | Description |
|---|---|
| Monitor A/B/C... | Select already created monitors as combination targets; the right side shows their BY grouping conditions |
| Add Monitor | Click to add more monitors; up to 10 monitors are supported |
Note
If a monitor's BY configuration does not comply with the rules (e.g., grouping dimensions have no intersection), the monitor can still be created successfully, but it will not generate alerts.
Combination Method¶
Use a logical expression with AND, OR, and NOT to define whether the composite monitor triggers an event. When all selected monitors trigger an abnormal state, the expression resolves to true (true); otherwise, it resolves to false (false).
1. Supported Operators
| Operator | Description | Example |
|---|---|---|
&& |
AND | A && B: both A and B are in an abnormal state |
\|\| |
OR | A \|\| B: either A or B is in an abnormal state |
! |
NOT | !C: C is not in an abnormal state |
2. Complex Expressions
Combined usage is supported, such as A && B || !C
Logical Evaluation in Detail¶
How "True" (true) Is Defined¶
Based on the selected monitors, if any monitor has groups, the expression resolves to "true" (true) only when the groups shared by all monitors are in an abnormal state.
Example: If monitor A (hosts 1, 2, 3, and 4 generating alerts) and monitor B (hosts 2, 3, 5, and 6 generating alerts) are selected, the composite monitor (A&&B) returns "true" (true) only for hosts 2 and 3, generating alerts.
Handling Inconsistent Groups¶
When the monitors in the combination have inconsistent groups, the system uses the intersection of the grouping dimensions as the final dimension_tags.
*Example: Select monitor A: by host; monitor B: by host, device.
In this case, the intersection host is used as the final dimension. Monitor A is evaluated as usual, while for monitor B, the most severe level across all device values of each host is used as that host's status:
| Monitor B Original Status | Status After Aggregation (by host) |
|---|---|
| Host a, device1: error Host a, device2: critical Host a, device3: ok |
Host a: critical (most severe) |
| Host b, device4: error Host b, device5: info |
Host b: error (most severe) |
No Shared Groups: If the monitors' groups have no intersection (e.g., A groups by host and B by pod), no alerts are generated.
Subsequent Configuration¶
After completing the detection configuration above, continue with:
- Event Notifications: define the event title, content, notified members, missing data handling, and linked incidents;
- Alert Configuration: select an alert policy, configure notification targets and mute periods;
- Link: link dashboards for quick navigation to view data;
- Permissions: set operation permissions to control who can edit/delete this monitor.
FAQ¶
Do the original monitors being combined continue to monitor normally?
Yes. The combined monitors are not affected in any way; they still run and alert independently according to their own configurations.
How are triggers calculated for a composite monitor?
Each detection counts as 1 trigger. The detection frequency is the same as the largest detection frequency among the combined monitors.