Monitor trigger performance

After you create or edit a trigger, you can view the Runtime Log tab to check that the trigger is running as expected, without issues. The runtime log displays debug output, errors, and exceptions. This tab only appears after the trigger is saved.

1. Log into the Web UI on the ExtraHop Discover or Command appliance.
2. Click the System Settings icon , and then click Triggers.
3. Double-click the trigger you want to view.
4. Click the Runtime Log tab.

In the following example, the trigger monitors HTTP connections on selected devices and returns URIs that contain “seattle”.

if (HTTP.uri.match("seattle")){
    Application("Seattle App").commit();
    debug(HTTP.uri);
}

When a match occurs, the URI that contains the match is written to the runtime log as shown in the following figure:

The runtime log also displays any runtime errors or exceptions that occur, whether or not debugging is enabled on the Configuration tab. You should fix exceptions when they occur to minimize the performance impact on your system.

After you create or edit a trigger, you can view the Performance tab to view a graphical representation of the performance impact the trigger has on your environment. This tab only appears after the trigger is saved.

1. Log into the Web UI on the ExtraHop Discover or Command appliance.
2. Click the System Settings icon , and then click Triggers.
3. Double-click the trigger you want to view.
4. Click the Performance tab.

The tab displays a trigger performance graph that tracks the number of cycles the trigger has consumed within a given time interval. You can hover over a data point to display key performance metrics at a single point in time.

The hover tip includes the following information:

• The most and least cycles the trigger consumed to process a single event.
• The number of times the trigger ran and the percentage of times the trigger ran compared to all triggers that ran in the same time range.
• The total number of cycles consumed by the trigger and the percentage of cycles consumed compared to all triggers that ran in the same time range.

After you have built a trigger, view several System Health charts that indicate the collective impact of all of your triggers on the system. You can monitor these charts for problems that affect system performance or result in incorrect data.

1. Click the System Settings icon , and then click System Health.
2. View the following charts:

   Option	Description
   Trigger Executes by Trigger	Displays all triggers running on the system. If the trigger you just created or modified is not listed, there might be an issue with the trigger script.
   Trigger Executes	Displays bursts of trigger activity that might indicate inefficient behavior from one or more triggers. If any bursts of activity are displayed, view the Trigger Executes by Trigger chart to locate any trigger that is consuming higher resources than average, which can indicate that the trigger has a poorly-optimized script that is affecting performance.
   Trigger Exceptions by Trigger	Displays any exceptions caused by triggers. Exceptions are a large contributor to system performance issues and should be corrected immediately.
   Trigger Drops	Displays the number of triggers that have been dropped from the trigger queue. A common cause of dropped triggers is a long-running trigger that is dominating resource consumption. A healthy system should have 0 drops at all times.
   Trigger Load	Tracks the usage of all available resources by triggers. A high load is approximately 50%. Look for spikes in consumption that can indicate that a new trigger has been introduced or that an existing trigger is having issues.

   You can monitor whether your datastore triggers, also referred to as bridge triggers, are running properly with the following charts:

   • Datastore trigger executes
   • Datastore trigger exceptions by trigger
   • Datastore trigger drops