NRQL condition guided mode simplifies the creation of "host not reporting" (HNR) alerts. Instead of manually constructing an NRQL query, this guided approach helps you quickly define conditions for detecting when infrastructure agents stop sending data. This method offers greater flexibility for targeting specific host groups, customizing alert thresholds, and refining incident criteria compared to traditional HNR alerts.
Features
An HNR event is generated when the infrastructure agent fails to transmit data to our collector within a specified timeframe.
Host not reporting condition | Features |
|---|---|
What to monitor | You can use the entity filter bar to select which hosts you want to the NRQL alert condition to monitor. Based on your selections, the NRQL query will be automatically built for you. The condition will also automatically apply to any hosts you add in the future that match your condition's filters. |
How to notify | NRQL conditions are contained in policies. Policies use workflows and destinations to determine how to notify you when an incident is created. |
When to open an incident | HNR guided mode leads you through creating a loss of signal NRQL condition. This means you have full access to all of the loss of signal threshold settings including configuring the time window that triggers an HNR event and selecting from options: Close all current open incidents, Open new "lost signal" incident, and Do not open "lost signal" incident on expected termination. These settings, in combination with the policy's incident preferences, determine when an incident will open. |
Create a NRQL HNR alert condition
Navigation to an alert policy page.
Click New alert condition.
Select Use guided mode.
Select Hosts under the Tell us where to look category. (Note: If you don't see the "hosts" option, you may need to follow instructions to instrument your infrastructure.)
If Hosts isn't automatically selected for you under Select an entity type, choose Hosts again.
Click Next.
Under Select signal catgory, select Host.
Under Select a metric to monitor, select Host not reporting.
Now, you can use the entity filter to narrow the scope of the host(s) you want to monitor.
Click Next.
Under Consider the signal lost after, you have the option to adjust the time window from 30 seconds to 48 hours. You also have the option to adjust your loss of signal settings including selecting the option to skip opening an incident when the signal is expected to terminate (for example, if your host is expected to shut down).
Follow the remaining steps to finish configuring and save your alert condition.
Option: Do not open "lost signal" incident on expected termination
When you check the option Do not open "lost signal" incident on expected termination, you're telling New Relic to skip opening an incident when the signal is expected to terminate. This is useful when you know a host is going to shut down.
In order to enable this option, you must also have Open new "lost signal" incident checked. This way, New Relic knows to open a new incident when the signal is lost, but not when the signal is expected to be lost.
Importante
In order to prevent a loss of signal incident from opening when "Do not open "lost signal" incident on expected termination", the tag termination: expected must be added to the host entity. This tag tells us the signal was expected to terminate. See how to add the tag directly to the host entity.