Build a trigger to collect custom metrics for HTTP 404 errors

In the following steps, you will name and describe the trigger, enable debugging, and configure the trigger to run on HTTP response events.

1. Click the System Settings icon , and then click Triggers.
2. Click Create.
3. Type a name for the trigger. For this walkthrough, type HTTP 404 Errors.
4. Type a description of the trigger. For this walkthrough, type Track 404 errors back to the source.
5. Click Enable debug log.
6. Click in the Events field and select HTTP_RESPONSE from the list.

The following figure displays the trigger configuration attributes you configured above:

Next, add a simple debug statement to familiarize yourself with the trigger editor layout and features.

1. Click the Editor tab.
2. Add the following code to the editor:

   if (HTTP.statusCode === 404) {
       debug (HTTP.uri);
   }

   Copy

   Tip:

   The editor provides some autocomplete capabilities when typing code. For example, typing a dot (.) after selecting a class object results in a list of methods and properties applicable to the HTTP object. You can select the element you want from the list as shown in the following figure: Clicking the i icon displays a description of the current element, as shown in the following figure:

3. Click Save and Close.

Before the trigger can log output from the debug statement, you must assign the trigger to at least one device. For this walkthrough, you will assign the trigger to the HTTP server device group.

1. Click Assets from the top menu.
2. Click Device Groups, and then select HTTP Servers checkbox.
3. Click Assign Trigger from the top of the page to open a list of triggers that are eligible for assignment.
4. Select the HTTP 404 Errors trigger, and then click Assign Triggers.
5. Click the System Settings icon, return to the Triggers page, and select the HTTP 404 Errors trigger .
6. In the Assignments field, verify that the selected HTTP servers are added.

The field should look similar to the following figure:

The debug statement results have verified that there are URIs resulting in 404 status codes. In this section, you will create a custom metric named "404UriAndReferrer" to extract the invalid URIs and corresponding referrers.

1. In the right pane, add the following trigger code, highlighted in green, to the existing script:

   if (HTTP.statusCode === 404){
       debug (HTTP.uri);
       var app = Application("File Not Found");
   }

   Copy
   This code declares the application as a variable and specifies the application name. We recommend that you declare a variable for methods that you intend to call more than once to reduce resource consumption by the trigger. In this walkthrough, the code will call the application twice.
2. Add the following trigger code, highlighted in green, to the existing script:

   if (HTTP.statusCode === 404){
       debug (HTTP.uri);
       var app = Application("File Not Found");
       app.metricAddDetailCount(
           "404UriAndReferrer",
           "404:" + HTTP.uri + " | REFERRER:" + HTTP.referer,
           1);
   } 

   Copy
   The metricAddDetailCount method specifies the metric name and the event property data returned by the metric. The method also specifies the format of the extracted data as 404: <uri> | REFERRER: <uri> when displayed in a chart. See the Application section of the ExtraHop Trigger API Reference for more information about custom metric methods.
3. Click Save.

To view your custom metric, you must to add it to a chart widget on a dashboard. In the chart, the custom metric will reveal which URIs are invalid and the referrer of each invalid link.

1. On the Dashboard page, click the command menu in the upper right corner, and select Create Chart.
2. Click the empty chart widget in your newly created dashboard to launch the Metric Explorer.
3. Click Add Source.
4. Type and select File Not Found, which is the application created by the trigger.
5. In the Metrics field, type 404 and then select 404 Uri and Referrer, which is the custom metric created by the trigger.

   Note:

   The ExtraHop system converts the custom metric name you specified in the code to a friendly display name. In this walkthrough, "404UriAndReferrer" is converted to "404 Uri And Referrer". You can edit the friendly display name in the Metric Catalog. See the Metric Catalog section of the ExtraHop System User Guide for more information.

6. Select the Bar chart type from the bottom of the Metric Explorer.
7. In the lower right corner, click Add to Dashboard and select Create Dashboard.
8. Type a name for your dashboard in the Title field. For this walkthrough, type HTTP 404 Errors.
9. Click Create.

In the previous steps, you added code to the script to create an application as the source of your new custom metric. In this section, you will add code that enables the application to gather built-in HTTP metrics, but not custom metrics, to provide a tailored view of your web traffic each time a 404 status code occurs on the specified devices.

1. In the Trigger Configure window, click the Editor tab.
2. Add the following trigger code, highlighted in green, to the existing script:

   if (HTTP.statusCode === 404){
       debug (HTTP.uri);
       var app = Application("File Not Found");
       app.metricAddDetailCount(
           "404UriAndReferrer",
           "404:" + HTTP.uri + " | REFERRER:" + HTTP.referer,
           1);
       app.commit();
   }

   Copy
3. Click Save and Close.

The new "File Not Found" application is created the first time the trigger runs and the conditions specified by the trigger script are met. After you commit the application, it might take several minutes before the trigger runs and data is available in the application.

1. Click Assets from the top menu.
2. In the left pane, click Applications, and then select the File Not Found application.
3. In the left pane, click HTTP to view the built-in HTTP metrics collected in the application.

The Web page should look similar to the following figure: