Network Data Monitoring¶

A tool for monitoring network performance metrics within a workspace, allowing users to set threshold ranges and trigger alerts when metrics exceed these thresholds. Guance supports configuring alerting rules for single metrics and allows customization of alert severity levels.

Use Cases¶

Supports monitoring metric data from data sources netflow/httpflow. For example, monitoring the request count, error count, and error rate for the httpflow data source on a host.

Configuration¶

Check Frequency¶

Refers to the execution frequency of the detection rule; defaults to 5 minutes.

Check Interval¶

Refers to the time range queried for the detection metrics each time the task is executed. The available check intervals vary depending on the check frequency.

Detection Metrics¶

Set the metrics for the detection data. Supports setting metric data for all/single services in the workspace list over a certain time range.

Trigger Conditions¶

Set trigger conditions for alert levels: You can freely configure one of the trigger conditions: Critical, High, Warning, Normal.

Configure the trigger conditions and severity. If the query result contains multiple values, an event is generated if any value meets the trigger condition.

For more details, refer to Event Level Description.

Consecutive Trigger Judgment¶

If Consecutive Trigger Judgment is enabled, you can configure that an event is triggered only after the trigger condition is met consecutively for a specified number of times. The maximum is 10 times.

Bulk Alert Protection¶

Enabled by default.

When the number of alerts generated in a single detection exceeds a preset threshold, the system automatically switches to a status aggregation strategy: instead of processing each alert object individually, it generates a small number of summary alerts based on event status and pushes them.

This ensures timely notification while significantly reducing alert noise and avoiding timeout risks caused by processing too many alerts.

Alert Level¶

1. Alert Level Critical (red), High (orange), Warning (yellow);

2. Alert Level Normal (green): Based on the configured number of detection times, explained as follows:

   • Each execution of a detection task counts as 1 detection. For example, if Check Frequency = 5 minutes, then 1 detection = 5 minutes;

   • The number of detections can be customized. For example, if Check Frequency = 5 minutes, then 3 detections = 15 minutes.

   Level

   Description

   Normal

   After the detection rule takes effect, if the data detection result returns to normal within the configured number of custom detections after a Critical, High, or Warning abnormal event is generated, a recovery alert event is generated. ❗️ Recovery alert events are not subject to Alert Silence restrictions. If the number of detections for recovery alert events is not set, the alert event will not recover and will remain in the Events > Unrecovered Events List.

Data Gap¶

Seven strategies can be configured for data gap status.

1. Linked with the check interval time range, judge the query result of the detection metrics for the most recent minutes, do not trigger an event;

2. Linked with the check interval time range, judge the query result of the detection metrics for the most recent minutes, treat the query result as 0; at this time, the query result will be re-compared with the threshold configured in the Trigger Conditions above to determine whether to trigger an abnormal event.

3. Custom fill the check interval value, trigger data gap event, trigger critical event, trigger high event, trigger warning event, and trigger recovery event; for this type of configuration strategy, the custom data gap time configuration is recommended to be >= the check interval time span. If the configured time is <= the check interval time span, situations where both data gap and abnormal conditions are met may occur. In such cases, only the data gap processing result will be applied.

Information Generation¶

Enable this option to generate "Information" events for detection results that do not match any of the above trigger conditions.

Other Configuration¶

For more details, refer to Rule Configuration.