Device Health Events (Application N/A)

Some device health event data in the pipeline has no associated application An entity type representing software applications deployed in the customer environment that are monitored for performance and anomalies.. For those events, the application is reported as N/A. IQ Ops does not track these events by application and location An entity type representing physical or logical locations in the customer environment where entities are deployed and monitored.. Instead, it tracks them by health event name and location. This approach gives you analytics and incidents A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. for device health issues that are not tied to a specific application An entity type representing software applications deployed in the customer environment that are monitored for performance and anomalies..

How health event + location tracking works

Health event objects that have application N/A flow through the data pipeline in a similar way to application-location objects. The analytics engine treats them as a separate entity type. It uses the same baseline-based detection One or more indicators that are correlated and may act as a trigger for incident creation or runbook execution. logic as for application-location health events (e.g. Unique Critical Health Events and Unique Major Health Events). The difference is the dimension: analytics queries health event + location from the stream and raises indicators An observed change in a specific metric stream that is recognized as being outside of an expected model. Indicators are correlated into triggers, and one or more triggers are grouped into incidents. when the count for a given health event name and location exceeds the expected baseline.

The entity type for these objects is Health Event Location (health_event_location). When an indicator is created, IQ Ops creates a Health Event Location Issue incident. The incident is tied to the health event name and location, not to an application.

Incidents and runbooks

You can view and filter Health Event Location Issue incidents from the Incidents page. To automate response, use the Health Event/Location runbook trigger. That trigger runs when a health event occurs at a location and supplies the health event name and location to the runbook. For more on runbooks for health events, see Aternity Health Event Incident Automation (the same runbook patterns apply. The trigger entity is health event + location instead of application + location).

Correlation and rollup

Correlation rules do not currently apply to Health Event Location entities. IQ Ops does not roll up multiple indicators for the same or different health event names and locations into a single incident. Each indicator produces its own incident. If correlation or rollup is added for these entities in a later release, the documentation will be updated.