Metric for incoming traffic by calling host or process

[Bert_VanderHeyd]

Via "Analyse Process Connections" we can see which host/process is calling our host and what volumes we are talking about. That's great but it's quite deep dive.

For a certain fileserver we want to keep track of the incoming traffic and where it comes from. There are a few metrics for that but none of them have a "calling host" dimension or something like that. See builtin:host.net.nic.trafficIn can be split by host and NIC. But that doesn't tell where the traffic comes from. We know the data is available because we have those details via "Analyse Process Connections".

Is this feasible? And how? For this particular service we want it on a dashboard. Maybe even create alerts when certain incoming spikes arise.

[mark_bley · Accepted solution]

Hi @Bert_VanderHeyd ,

you can use a more specific entitySelector in your metric query to get the calling PGIs of the PGI (for my example PROCESS_GROUP_INSTANCE-19A05BD896B3AD67) you want to check e.g.: type(process_group_instance),fromRelationships.isNetworkClientOf(entityId(PROCESS_GROUP_INSTANCE-19A05BD896B3AD67))

The :parents suffix will as well give you the host where the calling PGIs come form.

So your complete query could look like this

builtin:tech.generic.network.traffic.trafficIn:filter(and(or(in(
"dt.entity.process_group_instance",
entitySelector("type(process_group_instance),fromRelationships.isNetworkClientOf(entityId(PROCESS_GROUP_INSTANCE-19A05BD896B3AD67))")
)))):splitBy("dt.entity.process_group_instance"):sort(value(auto,descending)):limit(20):parents

Hope this helps.

BR,

Mark