Skip to content

Trigger queries

A trigger query consists of one set of comparisons, and optionally, additional sets of child comparisons. For each set of comparisons, you specify whether the set is satisfied when all or any of its comparisons are satisfied.

Note

The action service does not check queries for consistency. For example, a trigger query that specifies "severity equal to critical and severity equal to error" is not marked as an error, even though it is inconsistent.

Trigger query builder

The following graphic shows an example of the query builder in the ADD TRIGGER dialog. (The default query builder includes just one comparison set; this example has two.)

The following table describes the major components of the query builder.

Item Description
Comparison set 1 / 2

A trigger query consists of one or more comparison sets; this example has two. The comparisons in a child set are evaluated when the comparisons in its parent set are satisfied.

Relationship type

The logic to use to join comparisons and the child set, if any.

  • Relationship type All joins with logical AND.
  • Relationship type Any joins with logical OR.
Comparison
  • The left side specifies the field to use in the comparison, which varies by trigger type (anomaly fields, event fields, metric fields).
  • The middle specifies the comparison operator. The available operators vary by the field selected for the left side.
  • The right side specifies the value to use in the comparison. The value type varies by the field selected for the left side, too.

Example event query

The following event query includes two sets of comparisons:

The following text summarizes the logic of the preceding query:

"Source Type" equal to "cz"AND
"Summary" contains "periphery"AND
"Acknowledged" not equal to True
  AND
  "Severity" greater than or equal to "error"OR
  "Status" not equal to "closed"

The parent set includes three comparisons, all of which must be satisfied. The child set includes two comparisons, either one of which must be satisfied. The child set is not evaluated unless the parent set is satisfied.

Anomaly trigger fields

The following table describes the fields available in the query builder for anomaly triggers.

Field Description
Metric Name

The name of a metric.

Metric ID

The unique identifier of a metric.

Entity ID

The unique identifier of an entity.

Entity Title

The name of an entity.

Device Name

The Collection Zone device name of an entity.

Device Class

The name of the Collection Zone device class.

Group The name of the Collection Zone Groups organizer.
System The name of the Collection Zone Systems organizer.
Location The name of the Collection Zone Locations organizer.
Source Type

The class name of the application sending data to Zenoss Cloud.

For Collection Zones, the value is cz.

Production State

The entity production state.

Typically, the value is one of production, pre-production, test, maintenance, or decommissioned.

Event trigger fields

The following table describes the fields available in the query builder for event triggers.

Field Description
Severity

The event severity level.

The value is one of critical, error, warning, info, or debug.

Status

The event status.

The value is one of open, suppressed, or closed.

Acknowledged

A value that indicates whether the event has been acknowledged.

  • If true, the event has been acknowledged.
  • If any other value, the event has not been acknowledged.
Summary The event summary.
Body The body of the event message.
Type (Sources other than Collection Zones only) Information about the event type.
Name The event name.
Source The instance identifier of the source type. For example, cz0.
CZ Event Class

The name of the Collection Zone event class associated with the event, either at creation or during a subsequent mapping.

Each Collection Zone can have its own set of customized event classes.

CZ Message The body of the Collection Zone event message.
CZ Entity Type

The type of Collection Zone entity from which the event originated.

The value is one of DEVICE, COMPONENT, SERVICE, or ORGANIZER.

CZ Parent Entity Type

The type of the Collection Zone parent entity from which the event originated.

The value is one of DEVICE, COMPONENT, SERVICE, or ORGANIZER.

CZ Parent Entity Title The title of the Collection Zone parent entity from which the event originated.
CZ Parent Entity ID The Collection Zone ID of the parent entity from which the event originated.
CZ Production State

The Collection Zone production state name, if the state is one of the default states.

The value is one of production, pre-production, test, maintenance, or decommissioned.

CZ Production State (Custom)

A number that represents a customized Collection Zone production state.

Each Collection Zone can have its own set of customized production states.

CZ Priority

The Collection Zone device priority, if the priority is one of the default priorities.

The value is one of highest, high, normal, low, lowest, or trivial.

CZ Priority (Custom)

A number that represents a customized Collection Zone device priority.

Each Collection Zone can have its own set of customized device priorities.

CZ Collector

The name of the Collection Zone collector where the event originated.

CZ Agent

The name of the Collection Zone service that generated the event.

For example, zenperfsnmp or zenpython.

Entity ID

The ID of the entity associated with the event.

Entity Title

The name of the entity associated with the event.

Device Name

The device name of the entity associated with the event.

Device Class

The name of the Collection Zone device class to which the entity associated with the event belongs.

Group The name of the Collection Zone Groups organizer to which the entity associated with the event belongs.
System The name of the Collection Zone Systems organizer to which the entity associated with the event belongs.
Location The name of the Collection Zone Locations organizer to which the entity associated with the event belongs.
Source Type

The class name of the entity associated with the event.

For Collection Zone entities, the value is cz.

Metric trigger fields

The following table describes the fields available in the query builder for metric triggers.

Field Description
Metric ID

The unique identifier of a metric.

Entity ID

The unique identifier of the entity associated with the metric.

Entity Title

The name of the entity associated with the metric.

Device Name

The device name of the entity associated with the metric.

Device Class

The name of the Collection Zone device class to which the entity associated with the metric belongs.

Group The name of the Collection Zone Groups organizer to which the entity associated with the metric belongs.
System The name of the Collection Zone Systems organizer to which the entity associated with the metric belongs.
Location The name of the Collection Zone Locations organizer to which the entity associated with the metric belongs.
Source Type

The class name of the entity associated with the metric.

For Collection Zone entities, the value is cz.

Production State

The production state of the entity associated with the metric.

Typically, the value is one of production, pre-production, test, maintenance, or decommissioned.