Aggregate functions in monitors and conditions

If an aggregate function or operator is used in the definition of the monitor, an aggregate function or operator can not be used in a condition expression for that monitor.

If the aggregate function is defined at monitor level, the time series graph for the monitored resource is a graph of the results of that aggregate function. In contrast, if the aggregate function is used in the condition expression, the time series graph for the agent in the Web UI is based on raw data.

The following example shows an aggregate function, Average(uri), that is defined in the monitor. The function uses the wildcard to average the received packets from all the interfaces, resulting in a graph with a single curve, and triggering an alert when that average is over 50.

uri = '/rest/v1/system/interfaces/*?attributes=statistics.rx_packets'
avg = Average(uri)
self.monitor1 = Monitor(avg, name='Average Rx Packets on All Interfaces')
self.rule1 = Rule('Rx Packets')
self.rule1.condition('{} > 50', [self.monitor1])

The following example shows the avg aggregate function used in a condition expression. The monitor results in a graph that has multiple curves, with one curve corresponding to each interface received packet value. In the example, the condition self.rule2.condition triggers an alert when the average of received packets on an interface becomes greater than 50 within the past five minutes.

uri = '/rest/v1/system/interfaces/*?attributes=statistics.rx_packets'
avg = AverageOverTime(uri, "5 minutes")
self.monitor2 = Monitor(uri, name='Rx Packets on All Interfaces')
self.rule2 = Rule('Rx Packets')
self.rule2.condition('avg {} > 50', [self.monitor2])