zqr10159 commented on issue #3736:
URL: https://github.com/apache/hertzbeat/issues/3736#issuecomment-3244033571
You can use only a Scheduled Threshold to cover both “process missing” and
“process unhealthy” if a small detection delay is acceptable.
How to do it (step by step):
- Navigate: Alerting -> Threshold -> New -> Scheduled Threshold Rule.
- Metric Object: Select your Windows process metrics (pick the
process-related metric object shown in the UI).
- Rule Type: Use expression/PromQL mode.
- Add one or both expressions below (adjust metric and label names to match
what you see, e.g., name/status/cmdline/path, process_up, etc.). Bind the rule
to the specific monitor(s), set an Alert Level, and set Trigger Count > 1 to
avoid flapping. Save.
PromQL examples to copy and adapt:
- Detect the process is missing
- Immediate:
- count(process_info{name="yourproc.exe"}) == 0
- OR absent(process_info{name="yourproc.exe"})
- Over a short window (reduces noise):
- max_over_time((count(process_info{name="yourproc.exe"}) == 0)[3m]) > 0
- Detect the process is unhealthy (exists but not “running”)
- If you have a boolean up/running metric:
- max_over_time((process_up{name="yourproc.exe"} == 0)[3m]) > 0
- If health is exposed via a status label (e.g., status!="running"):
- max_over_time((count(process_status{name="yourproc.exe",
status!="running"}) > 0)[3m]) > 0
Tips:
- Prefer exact or regex matches on a unique identifier to avoid false
positives:
- name="yourproc.exe"
- or cmdline=~".*\\\\your-app\\\\bin\\\\yourproc\\.exe.*"
- Use a short window like [2m]–[5m] and Trigger Count 2–3 to balance
sensitivity vs. noise.
- Scheduled-only adds a small delay but simplifies configuration; if you
need instant alerts when the process turns unhealthy while present, you can
still add a real-time rule later.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
