Monitor trigger performance

After you create or edit a trigger, you can view the Debug Log tab to check that the trigger is running as expected, without issues. The debug log displays debug output, errors, and exceptions. This tab only appears after the trigger is saved.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. Click the System Settings icon , and then click Triggers.
3. Click the name of the trigger you want to view.
4. Click Edit Trigger Script.
5. Click the Debug Log tab.

In the following example, the trigger monitors HTTP connections on selected devices and returns URIs that contain "seattle".

if (HTTP.uri.match("seattle")){
    Application("Seattle App").commit();
    debug(HTTP.uri);
}

Copy

When a match occurs, the URI that contains the match is written to the debug log as shown in the following figure:

The debug log also displays any runtime errors or exceptions that occur, whether or not debugging is enabled on the Configuration tab. You should fix exceptions when they occur to minimize the performance impact on your system.

After you create or edit a trigger, you can view the Performance tab to view a graphical representation of the performance impact the trigger has on your environment. This tab only appears after the trigger is saved.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. Click the System Settings icon , and then click Triggers.
3. Click the trigger you want to view.
4. In the Edit Trigger pane, scroll down to the Capture Trigger Load chart.

The tab displays a trigger performance graph that tracks the number of cycles the trigger has consumed within a given time interval.

After you have built a trigger, view several System Health charts that indicate the collective impact of all of your triggers on the system. You can monitor these charts for problems that affect system performance or result in incorrect data.

1. Click the System Settings icon , and then click System Health.
2. View the following charts:

   Option	Description
   Trigger Executes by Trigger	Displays all triggers running on the system. If the trigger you just created or modified is not listed, there might be an issue with the trigger script.
   Trigger Executes	Displays bursts of trigger activity that might indicate inefficient behavior from one or more triggers. If any bursts of activity are displayed, view the Trigger Executes by Trigger chart to locate any trigger that is consuming higher resources than average, which can indicate that the trigger has a poorly-optimized script that is affecting performance.
   Trigger Exceptions by Trigger	Displays any exceptions caused by triggers. Exceptions are a large contributor to system performance issues and should be corrected immediately.
   Trigger Drops	Displays the number of triggers that have been dropped from the trigger queue. A common cause of dropped triggers is a long-running trigger that is dominating resource consumption. A healthy system should have 0 drops at all times.
   Trigger Load	Tracks the usage of all available resources by triggers. A high load is approximately 50%. Look for spikes in consumption that can indicate that a new trigger has been introduced or that an existing trigger is having issues.

   You can monitor whether your datastore triggers, also referred to as bridge triggers, are running properly with the following charts:

   • Datastore trigger executes
   • Datastore trigger exceptions by trigger
   • Datastore trigger drops