#1100 - Log Analytics alerting on Aborted OIC Instances

Introduction

An OIC customer wants to be informed, when an OIC instance aborts. This leads on from one of my recent posts on monitoring aborted instances. Please recognise the difference between flows that fail due to errors and those that abort. Here we are concerned purely with the latter.

I covered the creation of an OIC Errors Dashboard in the previous post. It contained the following widget, among many others - 

 

In this post I cover triggering an alarm from OCI Log Analytics, when an integration flow aborts.

Alarms in OCI Log Analytics

I begin with the activity stream log in Log Analytics. I can access this via Administration - Sources - 

Here I click Customize - 

and then click on Labels - Add Conditional Label -

As you can see, I added the following - 

I now click on Detection Rules - 

Note the use of the conditional label. 

Here I specified my own metric namespace, resource group and name. Also note the dimensions I have included. Here I added Integration, Identifier and Project Id.

The context sensitive menu for my detection rules contains the following option - Create Alarm, which I click.

  

The query is - 

new-oic-instance-aborted-metric[5m]

{rule_ocid = "ocid1.loganalyticsingesttimerule.myOcIDg

"}.grouping().sum()

This I amend to - 

new-oic-instance-aborted-metric[1m]{rule_ocid = "ocid1.loganalyticsingesttimerule.myOCID", Integration =~ "*", Identifier =~ "*", Project_ID =~ "*"}.sum() > 0

I need to include the dimensions, so they will be added to the alarm email.

I complete the Alarm, giving it a name etc. -

I also define the email body and set the severity to critical -

Let's test it out. I'll run an async integration and then abort it.

My Dashboard -

Now to the Alarm - I can check the Alarm Data section - 

The alarm has fired, so I check my email - 

I can return to the Dashboard and punchout -

This brings me to Log Explorer, where I can see who actually aborted the flow - oh no! It as me!

Summa Summarum

This is an excellent feature in Log Analytics and a BIG thank you to my esteemed colleague Varun K., for pointing this out to me. You can, of course, extrapolate from this and create other alarms, based on whatever conditions you want. Remember the conditional label I created? It's really as simple as that.