Trigger queries

A trigger query consists of at least one comparison clause. You can add a simple clause, a compund clause, or both. You can add as many clauses and compound clauses as you need. For each set of clauses, you specify whether the set is satisfied when all or any of its comparison clauses are satisfied.

Note

The Actions service doesn't check queries for consistency. For example, a trigger query that specifies "severity equal to critical and severity equal to error" isn't marked as an error, even though it's inconsistent.

Trigger query builder

Decide if you want your query to return true if Any of the values meet the conditions or only if All the values meet the conditions. Then add your comparison clauses:

To add a simple clause, click the Add simple clause (plus sign) button.
To add a compound clause, click the Add compound clause (return arrow) button.

To define the clauses, click in the first field to select an entity, metric, or other field name. This field offers suggestions based on the user-friendly names in the Dictionary or from live data in your system. The suggestions are also grouped by type for quicker browsing.

When you select the field name, the query builder automatically adjusts the operators available in the clause. For example, a field that is a string type has different operators than a field that is a numeric type.

Select your operator, then select your value. Start typing in the value field for autosuggestions based on your selected field name and operator.

To add another simple clause or add a compound clause, use the buttons in the top of your query. To remove all the clauses, click the X button in the top of the query.

The following example shows the query builder in the ADD TRIGGER dialog box, but the same query builder is used in other Zenoss features, such as defining datasources for policies and creating an event.

The following table describes the major components of the query builder.

Item

Description

Comparison clause sets

A trigger query consists of one or more comparison clauses. This example shows two sets. When you click the **Add simple clause** (plus sign icon), you can add simple clauses to the comparison set. Click the **Add compound clause** (return arrow icon) to add another comparison set. The comparisons in a child set are evaluated when the comparisons in its parent set are satisfied.

Relationship type

Set the logic for joining comparisons and the child set, if any.

Relationship type All joins with logical AND.
Relationship type Any joins with logical OR.

Clause

For each comparison clause, select the field, operator, and value.

In the left textbox, specify the field to use in the comparison, which varies by trigger type (anomaly fields, event fields, metric fields).
Then select the comparison operator. The available operators vary by the field selected.
Last, specify the value to use in the comparison. The value type varies by the field selected.

Example event query

The following event query includes two sets of comparisons:

The following text summarizes the logic of the preceding query:

"Source Type" equal to "cz"AND
"Summary" contains "periphery"AND
"Acknowledged" not equal to True
AND
"Severity" greater than or equal to "error"OR
"Status" not equal to "closed"

The parent set includes three comparisons, all of which must be satisfied. The child set includes two comparisons, either one of which must be satisfied. The child set is not evaluated unless the parent set is satisfied.

Anomaly trigger fields

The following table describes the fields available in the query builder for anomaly triggers.

Field	Description
Metric Name	The name of a metric.
Metric ID	The unique identifier of a metric.
Entity ID	The unique identifier of an entity.
Entity Title	The name of an entity.
Device Name	The Collection Zone device name of an entity.
Device Class	The name of the Collection Zone device class.
Group	The name of the Collection Zone Groups organizer.
System	The name of the Collection Zone Systems organizer.
Location	The name of the Collection Zone Locations organizer.
Source Type	The class name of the application sending data to Zenoss Cloud. For Collection Zones, the value is `cz`.
Production State	The entity production state. Typically, the value is one of `production`, `pre-production`, `test`, `maintenance`, or `decommissioned`.

Event trigger fields

The following table describes the fields available in the query builder for event triggers.

Note

These are just some of the typical fields that are available. More fields might be available in your system if the field is part of your streaming data or if you added it to the Dictionary.

Field	Description
Severity	The event severity level. The value is one of `critical`, `error`, `warning`, `info`, or `debug`.
Status	The event status. The value is one of `open`, `suppressed`, or `closed`.
Acknowledged	A value that indicates whether the event has been acknowledged. If `true`, the event has been acknowledged. If any other value, the event has not been acknowledged.
Summary	The event summary.
Body	The body of the event message.
Type	(Sources other than Collection Zones only) Information about the event type.
Name	The event name.
Source	The instance identifier of the source type. For example, `cz0`.
CZ Event Class	The name of the Collection Zone event class associated with the event, either at creation or during a subsequent mapping. Each Collection Zone can have its own set of customized event classes.
CZ Message	The body of the Collection Zone event message.
CZ Entity Type	The type of Collection Zone entity from which the event originated. The value is one of `DEVICE`, `COMPONENT`, `SERVICE`, or `ORGANIZER`.
CZ Parent Entity Type	The type of the Collection Zone parent entity from which the event originated. The value is one of `DEVICE`, `COMPONENT`, `SERVICE`, or `ORGANIZER`.
CZ Parent Entity Title	The title of the Collection Zone parent entity from which the event originated.
CZ Parent Entity ID	The Collection Zone ID of the parent entity from which the event originated.
CZ Production State	The Collection Zone production state name, if the state is one of the default states. The value is one of `production`, `pre-production`, `test`, `maintenance`, or `decommissioned`.
CZ Production State (Custom)	A number that represents a customized Collection Zone production state. Each Collection Zone can have its own set of customized production states.
CZ Priority	The Collection Zone device priority, if the priority is one of the default priorities. The value is one of `highest`, `high`, `normal`, `low`, `lowest`, or `trivial`.
CZ Priority (Custom)	A number that represents a customized Collection Zone device priority. Each Collection Zone can have its own set of customized device priorities.
CZ Collector	The name of the Collection Zone collector where the event originated.
CZ Agent	The name of the Collection Zone service that generated the event. For example, `zenperfsnmp` or `zenpython`.
Entity ID	The ID of the entity associated with the event.
Entity Title	The name of the entity associated with the event.
Device Name	The device name of the entity associated with the event.
Device Class	The name of the Collection Zone device class to which the entity associated with the event belongs.
Group	The name of the Collection Zone Groups organizer to which the entity associated with the event belongs.
System	The name of the Collection Zone Systems organizer to which the entity associated with the event belongs.
Location	The name of the Collection Zone Locations organizer to which the entity associated with the event belongs.
Source Type	The class name of the entity associated with the event. For Collection Zone entities, the value is `cz`.

Metric trigger fields

The following table describes the fields available in the query builder for metric triggers.

Field	Description
Metric ID	The unique identifier of a metric.
Entity ID	The unique identifier of the entity associated with the metric.
Entity Title	The name of the entity associated with the metric.
Device Name	The device name of the entity associated with the metric.
Device Class	The name of the Collection Zone device class to which the entity associated with the metric belongs.
Group	The name of the Collection Zone Groups organizer to which the entity associated with the metric belongs.
System	The name of the Collection Zone Systems organizer to which the entity associated with the metric belongs.
Location	The name of the Collection Zone Locations organizer to which the entity associated with the metric belongs.
Source Type	The class name of the entity associated with the metric. For Collection Zone entities, the value is `cz`.
Production State	The production state of the entity associated with the metric. Typically, the value is one of `production`, `pre-production`, `test`, `maintenance`, or `decommissioned`.