Trigger queries

A trigger query consists of one set of comparisons, and optionally, additional sets of child comparisons. For each set of comparisons, you specify whether the set is satisfied when all or any of its comparisons are satisfied.

Note

The action service does not check queries for consistency. For example, a trigger query that specifies "severity equal to critical and severity equal to error" is not marked as an error, even though it is inconsistent.

Trigger query builder

The following graphic shows an example of the query builder in the ADD TRIGGER dialog. (The default query builder includes just one comparison set; this example has two.)

The following table describes the major components of the query builder.

Item

Description

Comparison set 1 / 2

A trigger query consists of one or more comparison sets; this example has two. The comparisons in a child set are evaluated when the comparisons in its parent set are satisfied.

Relationship type

The logic to use to join comparisons and the child set, if any.

Relationship type All joins with logical AND.
Relationship type Any joins with logical OR.

Comparison

The left side specifies the field to use in the comparison, which varies by trigger type (anomaly fields, event fields, metric fields).
The middle specifies the comparison operator. The available operators vary by the field selected for the left side.
The right side specifies the value to use in the comparison. The value type varies by the field selected for the left side, too.

Example event query

The following event query includes two sets of comparisons:

The following text summarizes the logic of the preceding query:

"Source Type" equal to "cz"AND
"Summary" contains "periphery"AND
"Acknowledged" not equal to True
AND
"Severity" greater than or equal to "error"OR
"Status" not equal to "closed"

The parent set includes three comparisons, all of which must be satisfied. The child set includes two comparisons, either one of which must be satisfied. The child set is not evaluated unless the parent set is satisfied.

Anomaly trigger fields

The following table describes the fields available in the query builder for anomaly triggers.

Field	Description
Metric Name	The name of a metric.
Metric ID	The unique identifier of a metric.
Entity ID	The unique identifier of an entity.
Entity Title	The name of an entity.
Device Name	The Collection Zone device name of an entity.
Device Class	The name of the Collection Zone device class.
Group	The name of the Collection Zone Groups organizer.
System	The name of the Collection Zone Systems organizer.
Location	The name of the Collection Zone Locations organizer.
Source Type	The class name of the application sending data to Zenoss Cloud. For Collection Zones, the value is `cz`.
Production State	The entity production state. Typically, the value is one of `production`, `pre-production`, `test`, `maintenance`, or `decommissioned`.

Event trigger fields

The following table describes the fields available in the query builder for event triggers.

Field	Description
Severity	The event severity level. The value is one of `critical`, `error`, `warning`, `info`, or `debug`.
Status	The event status. The value is one of `open`, `suppressed`, or `closed`.
Acknowledged	A value that indicates whether the event has been acknowledged. If `true`, the event has been acknowledged. If any other value, the event has not been acknowledged.
Summary	The event summary.
Body	The body of the event message.
Type	(Sources other than Collection Zones only) Information about the event type.
Name	The event name.
Source	The instance identifier of the source type. For example, `cz0`.
CZ Event Class	The name of the Collection Zone event class associated with the event, either at creation or during a subsequent mapping. Each Collection Zone can have its own set of customized event classes.
CZ Message	The body of the Collection Zone event message.
CZ Entity Type	The type of Collection Zone entity from which the event originated. The value is one of `DEVICE`, `COMPONENT`, `SERVICE`, or `ORGANIZER`.
CZ Parent Entity Type	The type of the Collection Zone parent entity from which the event originated. The value is one of `DEVICE`, `COMPONENT`, `SERVICE`, or `ORGANIZER`.
CZ Parent Entity Title	The title of the Collection Zone parent entity from which the event originated.
CZ Parent Entity ID	The Collection Zone ID of the parent entity from which the event originated.
CZ Production State	The Collection Zone production state name, if the state is one of the default states. The value is one of `production`, `pre-production`, `test`, `maintenance`, or `decommissioned`.
CZ Production State (Custom)	A number that represents a customized Collection Zone production state. Each Collection Zone can have its own set of customized production states.
CZ Priority	The Collection Zone device priority, if the priority is one of the default priorities. The value is one of `highest`, `high`, `normal`, `low`, `lowest`, or `trivial`.
CZ Priority (Custom)	A number that represents a customized Collection Zone device priority. Each Collection Zone can have its own set of customized device priorities.
CZ Collector	The name of the Collection Zone collector where the event originated.
CZ Agent	The name of the Collection Zone service that generated the event. For example, `zenperfsnmp` or `zenpython`.
Entity ID	The ID of the entity associated with the event.
Entity Title	The name of the entity associated with the event.
Device Name	The device name of the entity associated with the event.
Device Class	The name of the Collection Zone device class to which the entity associated with the event belongs.
Group	The name of the Collection Zone Groups organizer to which the entity associated with the event belongs.
System	The name of the Collection Zone Systems organizer to which the entity associated with the event belongs.
Location	The name of the Collection Zone Locations organizer to which the entity associated with the event belongs.
Source Type	The class name of the entity associated with the event. For Collection Zone entities, the value is `cz`.

Metric trigger fields

The following table describes the fields available in the query builder for metric triggers.

Field	Description
Metric ID	The unique identifier of a metric.
Entity ID	The unique identifier of the entity associated with the metric.
Entity Title	The name of the entity associated with the metric.
Device Name	The device name of the entity associated with the metric.
Device Class	The name of the Collection Zone device class to which the entity associated with the metric belongs.
Group	The name of the Collection Zone Groups organizer to which the entity associated with the metric belongs.
System	The name of the Collection Zone Systems organizer to which the entity associated with the metric belongs.
Location	The name of the Collection Zone Locations organizer to which the entity associated with the metric belongs.
Source Type	The class name of the entity associated with the metric. For Collection Zone entities, the value is `cz`.
Production State	The production state of the entity associated with the metric. Typically, the value is one of `production`, `pre-production`, `test`, `maintenance`, or `decommissioned`.