# Alert Metrics Reference The following tables (arranged by alert tab, then by alert type) define the metrics available to those alert types as well as the metrics' operator functions and units. {% hint style="info" %} **The tables below include operators labelled "Dynamic (Classic)". These operators are being phased out as new alert rules are created and existing alert rules updated. However, all alert rules created before 17 September 2024 and still in use will show this operator as an option. Alert rules created after this date will only show "Dynamic" and "Static" options.** {% endhint %} ## Cloud and Enterprise Agent Alerts ### Alert Type: DNS Test Layer | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | ------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DNS Server | Error | What, if any, errors occurred when the test was running. | is present, matches, does not match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | DNS Server | Resolution Time | The time it takes to query a specific named server for the given domain. | | | | DNS Server | Mapping | The IP address a specified domain maps to. List can reflect IP addresses, CIDR blocks, or strings. Wildcards are supported for domains. | in, not in | | | DNS Trace | Error | What, if any, errors occurred when the test was running. | is present, matches, does not match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | DNS Trace | Mapping | The IP address a specified domain maps to. | in, not in | | | DNSSEC | Error | What, if any, errors occurred when the test was running. | is present, matches, doesn't match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | ### Alert Type: Routing Test Layer | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | ------------- | -------------- | ------------------------------------------------------------------------------------------------------------------ | ------------------------ | ---------------------------------------------------------- | | Routing | Reachability | Percentage of BGP monitors with an existing route to the target prefix, indicating global availability. | >, < | % (0–100) | | Routing | Path Changes | Average number of AS path updates per monitor over time, reflecting routing stability or instability. | >, < | Changes (numeric, e.g., 0, 1, 2) | | Routing | Prefix | Specific IP prefix or prefix length advertised in BGP, used to verify expected or detect unexpected announcements. | in, not in | Prefix (e.g., `192.0.2.0/24`) or Prefix Length (e.g., /24) | | Routing | Covered Prefix | More specific prefix within a less specific target prefix, monitored for presence, absence, or specific values. | in, not in, exists | Prefix (e.g., `192.0.2.0/25`) or Prefix Length (e.g., /25) | | Routing | ASN | Autonomous System Number present or absent in the AS path, used to track specific ASes in routing. | in, not in | ASN (e.g., AS12345) | | Routing | BGP Origin | ASN that originates the prefix announcement, ensuring the correct AS advertises the prefix. | meets all of (ASN) | ASN (e.g., AS12345) | | Routing | Any BGP Hop | ASN present at any position in the AS path, detecting expected or unexpected ASes in the route. | meets all of | ASN (e.g., AS67890) | | Routing | No BGP Hop | ASN absent from the entire AS path, ensuring a specific AS is not traversed. | meets all of | ASN (e.g., AS11223) | | Routing | BGP Hop # | ASN present at a specific position in the AS path, validating a particular hop in the route. | meets all of | ASN (e.g., AS45678) and Hop Number (e.g., 2) | | Routing | RPKI Status | Validation status of the prefix’s Route Origin Authorization (ROA), indicating routing security compliance. | Valid, Invalid, NotFound | Status (Valid, Invalid, NotFound) | | Routing | Path Length | Number of ASes in the AS path to the prefix, indicating route efficiency or anomalies. | > | AS Count (numeric, e.g., 3, 5) | ### Alert Type: Network Test Layer | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | --------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Agent to Agent | Latency | The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply. | | | | Agent to Agent | Packet Loss | The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets sent by the agent, then dividing by the number of packets sent, then multiplying by 100. | ≤, ≥ | % | | Agent to Agent | Jitter | The mean deviation of latency. The mean deviation represents how far, on average, all measurements are from the mean of the data. | | | | Agent to Agent | Throughput | This is the Wire Size divided by the Receive Time. | ≥ | kbps | | Agent to Agent | Error | What, if any, errors occurred when the test was running. | is present, matches, doesn't match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Agent to Agent | DSCP | A Differentiated Services Code Point (DSCP) is a value found in an IP packet header which is used to request a level of priority for delivery (defined in [RFC 2474](https://www.ietf.org/rfc/rfc2474.txt)) | is, is not | Best Effort (DSCP 0), CS 1 (DSCP 8), AF 11 (DSCP 10), AF 12 (DSCP 12), AF 13 (DSCP 14), CS 2 (DSCP 16), AF 21 (DSCP 18), AF 22 (DSCP 20), AF 23 (DSCP 22), CS 3 (DSCP 24), AF 31 (DSCP 26), AF 32 (DSCP 28), AF 33 (DSCP 30), CS 4 (DSCP 32), AF 41 (DSCP 34), AF 42 (DSCP 36), AF 43 (DSCP 38), CS 5 (DSCP 40), Voice Admit (DSCP 44), EF (DSCP 46), CS 6 (DSCP 48), CS 7 (DSCP 56) | | Agent to Server | Error | What, if any, errors occurred when the test was running. | is present, matches, does not match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Agent to Server | Packet Loss | The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets. sent by the agent, then dividing by the number of packets sent, then multiplying by 100. | ≤, ≥ | % | | Agent to Server | Latency | The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply. | | | | Agent to Server | Jitter | The mean deviation of latency. The mean deviation represents how far, on average, all measurements are from the mean of the data. | | | | Agent to Server | Available Bandwidth | Total available bandwidth between source and destination measured in Mbps. | ≤, ≥ | Mbps | | Agent to Server | Capacity | This represents an estimation of the link capacity in Mbps, also used to measure the available bandwidth as a subsequent step. | ≤, ≥ | Mbps | | Agent to Server | Proxy Loss | The percentage of packets lost to the proxy. | ≤, ≥ | % | | Agent to Server | Proxy Latency | The average of the round-trip time to the proxy. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply. | | | | Agent to Server | Proxy Jitter | The mean deviation of proxy latency. The mean deviation represents how far, on average, all measurements are from the mean of the data. | | | | Path Trace | Any Hop > Delay | Estimated minimum transmission delay across a given link. The value is calculated by finding the agent that reported the lowest response time for the node on the right-hand side of the link (the node further from the agent), then subtracting the same agent's lowest detected response time for the node on the left-hand side of the link (the node closer to the agent). When a single path trace from a single agent traverses the link, this metric is called Delay. | ≤, ≥ | ms | | Path Trace | Any Hop > IP Address | An IP address is a unique address that identifies a device on the internet or a local network. | in, not in | | | Path Trace | Any Hop > ASN | Autonomous System Number assigned to a network prefix. | in, not in | | | Path Trace | Any Hop > rDNS | Reverse DNS (rDNS or RDNS) is a Domain Name Service (DNS) lookup of a domain name from an IP address. | in, not in | | | Path Trace | Any Hop > MPLS Label | Label associated with a given MultiProtocol Label Switching network. | in, not in | empty | | Path Trace | Any Hop > DSCP | A Differentiated Services Code Point (DSCP) is a value found in an IP packet header which is used to request a level of priority for delivery (defined in [RFC 2474](https://www.ietf.org/rfc/rfc2474.txt)) | is, is not | Best Effort (DSCP 0), CS 1 (DSCP 8), AF 11 (DSCP 10), AF 12 (DSCP 12), AF 13 (DSCP 14), CS 2 (DSCP 16), AF 21 (DSCP 18), AF 22 (DSCP 20), AF 23 (DSCP 22), CS 3 (DSCP 24), AF 31 (DSCP 26), AF 32 (DSCP 28), AF 33 (DSCP 30), CS 4 (DSCP 32), AF 41 (DSCP 34), AF 42 (DSCP 36), AF 43 (DSCP 38), CS 5 (DSCP 40), Voice Admit (DSCP 44), EF (DSCP 46), CS 6 (DSCP 48), CS 7 (DSCP 56) | | Path Trace | No Hop > Delay | Estimated minimum transmission delay across a given link. The value is calculated by finding the agent that reported the lowest response time for the node on the right-hand side of the link (the node further from the agent), then subtracting the same agent's lowest detected response time for the node on the left-hand side of the link (the node closer to the agent). When a single path trace from a single agent traverses the link, this metric is called Delay. | ≤, ≥ | ms | | Path Trace | No Hop > IP Address | An IP address is a unique address that identifies a device on the internet or a local network. | in, not in | | | Path Trace | No Hop > ASN | Autonomous System Number assigned to a network prefix. | in, not in | | | Path Trace | No Hop > rDNS | Reverse DNS (rDNS or RDNS) is a Domain Name Service (DNS) lookup of a domain name from an IP address. | in, not in | | | Path Trace | No Hop > MPLS Label | Label associated with a given MultiProtocol Label Switching network. | is, is not | empty | | Path Trace | No Hop > DCSP | A Differentiated Services Code Point (DSCP) is a value found in an IP packet header which is used to request a level of priority for delivery. (defined in [RFC 2474](https://www.ietf.org/rfc/rfc2474.txt)) | is, is not | Best Effort (DSCP 0), CS 1 (DSCP 8), AF 11 (DSCP 10), AF 12 (DSCP 12), AF 13 (DSCP 14), CS 2 (DSCP 16), AF 21 (DSCP 18), AF 22 (DSCP 20), AF 23 (DSCP 22), CS 3 (DSCP 24), AF 31 (DSCP 26), AF 32 (DSCP 28), AF 33 (DSCP 30), CS 4 (DSCP 32), AF 41 (DSCP 34), AF 42 (DSCP 36), AF 43 (DSCP 38), CS 5 (DSCP 40), Voice Admit (DSCP 44), EF (DSCP 46), CS 6 (DSCP 48), CS 7 (DSCP 56) | | Path Trace | Hop # (source/destination) > Delay | Estimated minimum transmission delay across a given link. The value is calculated by finding the agent that reported the lowest response time for the node on the right-hand side of the link (the node further from the agent), then subtracting the same agent's lowest detected response time for the node on the left-hand side of the link (the node closer to the agent). When a single path trace from a single agent traverses the link, this metric is called Delay. | ≤, ≥ | ms | | Path Trace | Hop # (source/destination) > IP Address | An IP address is a unique address that identifies a device on the internet or a local network. | in, not in | | | Path Trace | Hop # (source/destination) > ASN | Autonomous System Number assigned to a network prefix. | in, not in | | | Path Trace | Hop # (source/destination) > rDNS | Reverse DNS (rDNS or RDNS) is a Domain Name Service (DNS) lookup of a domain name from an IP address. | in, not in | | | Path Trace | Hop # (source/destination) > MPLS Label | Label associated with a given MultiProtocol Label Switching network. | is, is not | empty | | Path Trace | Hop # (source/destination) > DSCP | A Differentiated Services Code Point (DSCP) is a value found in an IP packet header which is used to request a level of priority for delivery (defined in [RFC 2474](https://www.ietf.org/rfc/rfc2474.txt)). | is, is not | Best Effort (DSCP 0), CS 1 (DSCP 8), AF 11 (DSCP 10), AF 12 (DSCP 12), AF 13 (DSCP 14), CS 2 (DSCP 16), AF 21 (DSCP 18), AF 22 (DSCP 20), AF 23 (DSCP 22), CS 3 (DSCP 24), AF 31 (DSCP 26), AF 32 (DSCP 28), AF 33 (DSCP 30), CS 4 (DSCP 32), AF 41 (DSCP 34), AF 42 (DSCP 36), AF 43 (DSCP 38), CS 5 (DSCP 40), Voice Admit (DSCP 44), EF (DSCP 46), CS 6 (DSCP 48), CS 7 (DSCP 56) | | Path Trace | Last Hop > Delay | Estimated minimum transmission delay across a given link. The value is calculated by finding the agent that reported the lowest response time for the node on the right-hand side of the link (the node further from the agent), then subtracting the same agent's lowest detected response time for the node on the left-hand side of the link (the node closer to the agent). When a single path trace from a single agent traverses the link, this metric is called Delay. | ≤, ≥ | ms | | Path Trace | Last Hop > IP Address | An IP address is a unique address that identifies a device on the internet or a local network. | in, not in | | | Path Trace | Last Hop > ASN | Autonomous System Number assigned to a network prefix. | in, not in | | | Path Trace | Last Hop > rDNS | Reverse DNS (rDNS or RDNS) is a Domain Name Service (DNS) lookup of a domain name from an IP address. | in, not in | | | Path Trace | Last Hop > MPLS Label | Label associated with a given MultiProtocol Label Switching network. | is, is not | empty | | Path Trace | Last Hop > DSCP | A Differentiated Services Code Point (DSCP) is a value found in an IP packet header which is used to request a level of priority for delivery (defined in [RFC 2474](https://www.ietf.org/rfc/rfc2474.txt)). | is, is not | Best Effort (DSCP 0), CS 1 (DSCP 8), AF 11 (DSCP 10), AF 12 (DSCP 12), AF 13 (DSCP 14), CS 2 (DSCP 16), AF 21 (DSCP 18), AF 22 (DSCP 20), AF 23 (DSCP 22), CS 3 (DSCP 24), AF 31 (DSCP 26), AF 32 (DSCP 28), AF 33 (DSCP 30), CS 4 (DSCP 32), AF 41 (DSCP 34), AF 42 (DSCP 36), AF 43 (DSCP 38), CS 5 (DSCP 40), Voice Admit (DSCP 44), EF (DSCP 46), CS 6 (DSCP 48), CS 7 (DSCP 56) | | Path Trace | Target IP Address | The IP Address a given test is targeting as determined by the DNS lookup if the test does not specify a specific IP Address. | in, not in | | | Path Trace | Server MSS | Maximum Segment Size accepted by the server. | <, > | bytes | | Path Trace | Path MTU | The maximum transmission unit (MTU) found on a given path. | <, > | bytes | | Path Trace | Path Length | Total number of hops of the path from source to target. | <, > | hops | | Path Trace | Trace is incomplete | Path does not reach its destination. | | | ### Alert Type: Voice Test Layer | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | ------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | RTP Stream | Error | What, if any, errors occurred when the test was running. | is present, matches, does not match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | RTP Stream | MOS | A number indicative of the perceived voice call quality. | ≤, ≥ | | | RTP Stream | Packet loss | The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets sent by the agent, then dividing by the number of packets sent, then multiplying by 100. | ≤, ≥ | % | | RTP Stream | Discards | UDP packets arriving too late and thus discarded. | ≤, ≥ | % | | RTP Stream | DSCP | A Differentiated Services Code Point (DSCP) is a value found in an IP packet header which is used to request a level of priority for delivery (defined in [RFC 2474](https://www.ietf.org/rfc/rfc2474.txt)). | is, is not | Best Effort (DSCP 0), CS 1 (DSCP 8), AF 11 (DSCP 10), AF 12 (DSCP 12), AF 13 (DSCP 14), CS 2 (DSCP 16), AF 21 (DSCP 18), AF 22 (DSCP 20), AF 23 (DSCP 22), CS 3 (DSCP 24), AF 31 (DSCP 26), AF 32 (DSCP 28), AF 33 (DSCP 30), CS 4 (DSCP 32), AF 41 (DSCP 34), AF 42 (DSCP 36), AF 43 (DSCP 38), CS 5 (DSCP 40), Voice Admit (DSCP 44), EF (DSCP 46), CS 6 (DSCP 48), CS 7 (DSCP 56) | | RTP Stream | Latency | The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply. | | | | RTP Stream | Packet Delay Variation | The average variation in unidirectional delay for packets reaching the destination. | | | | SIP Server | Error Type | A string from list of valid error types. | is, is not | Any, None, DNS, Connect, Register, Options, Invite, Server | | SIP Server | Response Code | The HTTP status code returned by the agent when fetching the URL. | is, is not | any error (≥ 400 or no response), OK (2xx), redirect (3xx), client error (4xx), server error (5xx), global error (6xx), custom code | | SIP Server | DNS Time | The time required for the agent to perform a DNS resolution of the hostname in the URL. | | | | SIP Server | Connect Time | The time required to establish a TCP connection with the web server. | | | | SIP Server | Register Time | The time it takes to register with the SIP target | | | | SIP Server | Options Time | The time required to negotiate what options will be used in the new connection | | | | SIP Server | Invite Time | How long the SIP invite handshake took. | | | | SIP Server | Wait Time | The time elapsed between the completion of sending the HTTP request and the time the agent receives the first byte of the response from the web server. | | | | SIP Server | Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | | | | SIP Server | Total Time | Time to perform the test, including DNS, Connect (when using TCP protocol), Redirects (if any), Register and Options phases of the test. | | | ### Alert Type: Web Test Layer | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | --------------------- | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | API | API Transaction Time | The total time taken by all of the API calls that run sequentially in an API test, averaged across each agent. | | | | API | API Completion | A percentage value indicating the number of API calls that succeeded in the selected test round. | ≤, ≥ | % | | API | Any Step > API Call Time | Total time the API Step took to complete. | ≤, ≥ | ms | | API | Any Step > Step Completion | Has a given API Test step completed. | completed, not completed | | | API | Any Step > Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | ≤, ≥, auto | ms | | API | Any Step > Receive Time | The time elapsed receiving the response from the server (time from first byte to last byte of payload). | ≤, ≥ | ms | | API | Any Step > Assert Error | Text returned by a Transaction or API assert error. | is present | | | API | Specific Step (Name, Step #) > API Call Time | Total time the API Step took to complete | ≤, ≥ | ms | | API | Specific Step (Name, Step #) > Step Completion | Has a given API Test step completed. | completed, not completed | | | API | Specific Step (Name, Step #) > Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | Auto, ≤, ≥ | ms | | API | Specific Step (Name, Step #) > Receive Time | The time elapsed receiving the response from the server (time from first byte to last byte of payload). | ≤, ≥ | ms | | API | Specific Step (Name, Step #) > Assert Error | Text returned by a Transaction or API assert error. | is present | | | FTP Server | Error Type | A string from list of valid error types. | is, is not | Any, None, DNS, Connect, SSL, Negotiation, Transfer, FTP, Content | | FTP Server | Reply Code | HTTP response code returned by the target. | is, is not | any error (≥ 400 or no response), OK (2xx), temporary failure (4xx), permanent failure (5xx), custom code | | FTP Server | DNS Time | The time required for the agent to perform a DNS resolution of the hostname in the URL. | | | | FTP Server | Connect Time | The time required to establish a TCP connection with the web server | | | | FTP Server | SSL Negotiation Time | The time required to negotiate SSL/TLS. | | | | FTP Server | FTP Negotiation Time | Beginning after Connect, up to the time the FTP upload, download or list command is issued (includes login). | | | | FTP Server | Wait Time | The time elapsed between the completion of sending the HTTP request and the time the agent receives the first byte of the response from the web server. | | | | FTP Server | Transfer Time | The time taken to transmit all bytes of the transfer. | | | | FTP Server | Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | | | | FTP Server | Total Time | Time to perform the test, including DNS, Connect (when using TCP protocol), Redirects (if any), Register and Options phases of the test. | | | | FTP Server | Throughput | This is the Wire Size divided by the Receive Time. | ≤, ≥ | kbps | | HTTP Server | Error | What, if any, errors occurred when the test was running. | | is present, matches, does not match | | HTTP Server | Error Type | A string from list of valid error types. | is, is not | Any, None, DNS, Connect, SSL, Send, Receive, SSL, Content | | HTTP Server | Response Code | The HTTP status code returned by the agent when fetching the URL. | is, is not | any error (≥ 400 or no response), OK (2xx), redirect (3xx), client error (4xx), server error (5xx), custom code | | HTTP Server | Response Header | Text match for response headers. | matches, doesn't match | [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | HTTP Server | Client SSL Alert Code | OpenSSL SSL error code. | is, is not | N/A, Unexpected Message (10), Bad Record MAC (20), Decryption Failed (21), Record Overflow (22), Decompression Failure (30), Handshake Failure (40), No Certificate (41), Bad Certificate (42), Unsupported Certificate (43), Certificate Revoked (44), Certificate Expired (45), Certificate Unknown (46), Illegal Parameter (47), Unknown CA (48), Access Denied (49), Decode Error (50), Decrypt Error (51), Export Restriction (60), Protocol Version (70), Insufficient Security (71), Internal Error (80), User Canceled (90), No Renegotiation (100), Unsupported Extension (110), Certificate Unobtainable (111), Unrecognized Name (112), Bad Certificate Status Response (113), Bad Certificate Hash Value (114), Unknown PSK Identity (115) | | HTTP Server | Server SSL Alert Code | OpenSSL SSL error code. | is, is not | N/A, Unexpected Message (10), Bad Record MAC (20), Decryption Failed (21), Record Overflow (22), Decompression Failure (30), Handshake Failure (40), No Certificate (41), Bad Certificate (42), Unsupported Certificate (43), Certificate Revoked (44), Certificate Expired (45), Certificate Unknown (46), Illegal Parameter (47), Unknown CA (48), Access Denied (49), Decode Error (50), Decrypt Error (51), Export Restriction (60), Protocol Version (70), Insufficient Security (71), Internal Error (80), User Canceled (90), No Renegotiation (100), Unsupported Extension (110), Certificate Unobtainable (111), Unrecognized Name (112), Bad Certificate Status Response (113), Bad Certificate Hash Value (114), Unknown PSK Identity (115) | | HTTP Server | Certificate | The number of days before certificate expiry the alert should trigger. | Expires within | days | | HTTP Server | Connect Time | The time required to establish a TCP connection with the web server. | | | | HTTP Server | DNS Time | The time required for the agent to perform a DNS resolution of the hostname in the URL. | | | | HTTP Server | SSL Negotiation Time | The time required to negotiate SSL/TLS. | | | | HTTP Server | Wait Time | The time elapsed between the completion of sending the HTTP request and the time the agent receives the first byte of the response from the web server. | | | | HTTP Server | Receive Time | The time elapsed receiving the response from the server (time from first byte to last byte of payload). | | | | HTTP Server | Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | | | | HTTP Server | Total Time | Time to perform the test, including DNS, Connect (when using TCP protocol), Redirects (if any), Register and Options phases of the test. | | | | HTTP Server | Throughput | This is the Wire Size divided by the Receive Time. | ≤, ≥ | kbps | | HTTP Server | Redirect Count | Number of redirects from the target page. | ≤, ≥ | | | HTTP Server | Total Wire Size | The size of all the objects in the page while in transmission. Often, HTTP responses are compressed prior to transmission, so wire size may be less than actual size if any objects are compressed by the server. | <, > | kB | | HTTP Server | SSL Version | Sends an alert if the SSL version used is in the defined list. Multiple versions can be selected at once. | in, not in | | | HTTP Server | Cipher Suite | The cipher suite used in SSL/TLS connections. ThousandEyes uses the OpenSSL naming convention for cipher suites, which is different from the IANA naming convention. | not in, is weak | | | Page Load | Page Load | Was the page successfully loaded. | has error, timed out, incomplete | | | Page Load | Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | | | | Page Load | Total Wire Size | The size of all the objects in the page while in transmission. Often, HTTP responses are compressed prior to transmission, so wire size may be less than actual size if any objects are compressed by the server. | <, > | kB | | Page Load | DOM Load Time | Also known as time-to-interaction, the time required for the browser to build the Document Object Model for the page, which is the skeleton of the page, not including images | | | | Page Load | Page Load Time | This maps to the load event triggered when the web page is fully loaded. Generally, the Page Load time is higher than the DOM Load time. | | | | Page Load | Error Count | Number of component errors. | ≤, ≥ | | | Page Load | Any Component > Domain | A domain name. | in, not in | | | Page Load | Any Component > Total Time | Time to perform the test, including DNS, Connect (when using TCP protocol), Redirects (if any), Register and Options phases of the test. | ≤, ≥ | ms | | Page Load | Any Component > Blocked Time | The time an HTTP request waits for system resources to become available that are needed to make a connection to a web server. The most common reason for significant blocking time is the per-domain concurrent connection limit. | ≤, ≥ | ms | | Page Load | Any Component > DNS Time | The time required for the agent to perform a DNS resolution of the hostname in the URL. | ≤, ≥ | ms | | Page Load | Any Component > Connect Time | The time required to establish a TCP connection with the web server. | ≤, ≥ | ms | | Page Load | Any Component > Wait Time | The time elapsed between the completion of sending the HTTP request and the time the agent receives the first byte of the response from the web server. | ≤, ≥ | ms | | Page Load | Any Component > Receive Time | The time elapsed receiving the response from the server (time from first byte to last byte of payload). | ≤, ≥ | ms | | Page Load | Any Component > SSL Negotiation Time | The time required to negotiate SSL/TLS. | ≤, ≥ | ms | | Page Load | Any Component > Component Load | Was the component load completed successfully. | is incomplete | | | Transaction | Any Page (all, any) > Page Load Time | This maps to the load event triggered when the web page is fully loaded. Generally, the Page Load time is higher than the DOM Load time. | ≤, ≥ | ms | | Transaction | Any Page (all, any) > Page Load Error | When the page load has a component error. | is present, matches | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Transaction | Any Page (all, any) > Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | ≤, ≥ | ms | | Transaction | Any Page (all, any) > DOM Load Time | Also known as time-to-interaction, the time required for the browser to build the Document Object Model for the page, which is the skeleton of the page, not including images. | ≤, ≥ | ms | | Transaction | Page (URL, Host, Page #) > Page Load Time | This maps to the load event triggered when the web page is fully loaded. Generally, the Page Load time is higher than the DOM Load time. | ≤, ≥ | ms | | Transaction | Page (URL, Host, Page #) > Page Load Error | When the page load has a component error. | is present, matches | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Transaction | Page (URL, Host, Page #) > Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | ≤, ≥ | ms | | Transaction | Page (URL, Host, Page #) > DOM Load Time | Also known as time-to-interaction, the time required for the browser to build the Document Object Model for the page, which is the skeleton of the page, not including images. | ≤, ≥ | ms | | Transaction | Marker (name) | Text name specified in a Transaction Test to document when test stages start and stop. | is present, is not present, duration (≤, ≥) | For duration: ms | | Transaction | Assert Error | Text returned by a Transaction or API assert error. | is present, matches, does not match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Transaction | Transaction Time | The time taken to execute the transaction, counting from the initial step until the final step. | | | | Transaction | Transaction Completion | Each web transaction has an initial and final step that can be configured by the user. Completion refers to the fraction of transaction steps that are executed between the initial and final steps | is finished, has error, has internal error, timed out | | | Transaction | Error | What, if any, errors occurred when the test was running | matches, is present, does not match | n/a, [POSIX Extended Regular Expression Sy](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Transaction (Classic) | Error | What, if any, errors occurred when the test was running | matches, is present, does not match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Transaction (Classic) | Transaction Time | The time taken to execute the transaction, counting from the initial step until the final step. | ≤, ≥ | ms | | Transaction (Classic) | Completion | | ≤, ≥ | % | | Transaction (Classic) | Steps Completed | Has a given API Test step complete | ≤, ≥, is | | | Transaction (Classic) | Any Step (all, any) > Step Duration | | ≤, ≥ | ms | | Transaction (Classic) | Step # (all, any) > Step Duration | | ≤, ≥ | ms | | Transaction (Classic) | Any Page (all, any) > Page Duration | | ≤, ≥ | ms | | Transaction (Classic) | Page # (all, any) > Page Duration | | ≤, ≥ | ms | ## Endpoint Agent Alerts ### Alert Type: Real User Tests | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | ------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | ------------ | | Application | Connection Failures Count | The count of TCP connection failures across agents running the test. | ≤, ≥ | | | Application | Content Time | The time it takes (once the main request has started) for the browser to fully load the HTML and build the DOM tree. External resources like pictures and stylesheets might not be fully loaded at this time | ≤, ≥ | ms | | Application | Error Count | Number of component errors | ≤, ≥ | | | Application | Experience Score | The experience score rates a user's experience when loading a particular page. The score is calculated based on the time to load the DOM of a page, which is then mapped to a score based on our dataset of load times | ≤, ≥ | % | | Application | Jitter | The mean deviation of latency. The mean deviation represents how far, on average, all measurements are from the mean of the data. | ≤, ≥ | ms | | Application | Latency | The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply. | ≤, ≥ | ms | | Application | Packet Loss | The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets sent by the agent, then dividing by the number of packets sent, then multiplying by 100 | ≤, ≥ | % | | Application | Page Load Time | This maps to the load event triggered when the web page is fully loaded. Generally, the Page Load time is higher than the DOM Load time. | ≤, ≥ | ms | | Application | Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | ≤, ≥ | ms | | Application | Signal Quality | The signal quality of the wireless connection, displayed as a percentage. A value of 0% implies an actual received signal strength indicator (RSSI) signal strength of -100 dBm (decibel-milliwatts). A value of 100% implies an actual RSSI signal strength of -50 dBm. | ≤, ≥ | % | | Endpoint | Connection Failures Count | The count of TCP connection failures across Agents running the test | ≤, ≥ | | | Endpoint | Content Time | The time it takes (once the main request has started) for the browser to fully load the HTML and build the DOM tree. External resources like pictures and stylesheets might not be fully loaded at this time | ≤, ≥ | ms | | Endpoint | CPU Utilization | Windows-based Endpoint Agents submit collected CPU usage metrics | ≤, ≥ | % | | Endpoint | Error Count | Number of component errors | ≤, ≥ | | | Endpoint | Experience Score | The experience score rates a user's experience when loading a particular page. The score is calculated based on the time to load the DOM of a page, which is then mapped to a score based on our dataset of load times | ≤, ≥ | % | | Endpoint | Jitter | The mean deviation of latency. The mean deviation represents how far, on average, all measurements are from the mean of the data. | ≤, ≥ | ms | | Endpoint | Latency | The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply | ≤, ≥ | ms | | Endpoint | Memory Load | Windows-based Endpoint Agents submit collected memory usage metrics | ≤, ≥ | % | | Endpoint | Packet Loss | The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets sent by the agent, then dividing by the number of packets sent, then multiplying by 100 | ≤, ≥ | % | | Endpoint | Page Load Time | This maps to the load event triggered when the web page is fully loaded. Generally, the Page Load time is higher than the DOM Load time. | ≤, ≥ | ms | | Endpoint | Signal Quality | The signal quality of the wireless connection, displayed as a percentage. A value of 0% implies an actual received signal strength indicator (RSSI) signal strength of -100 dBm. A value of 100% implies an actual RSSI signal strength of -50 dBm. | ≤, ≥ | % | ### Alert Type: Scheduled Tests | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | ---------------------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Endpoint End-to-End (Server) | CPU Utilization | Windows-based Endpoint Agents submit collected CPU Usage metrics. | ≤, ≥ | % | | Endpoint End-to-End (Server) | Error | What, if any, errors occurred when the test was running. | is present, matches, does not match | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Endpoint End-to-End (Server) | Jitter | The mean deviation of latency. The mean deviation represents how far, on average, all measurements are from the mean of the data. | | | | Endpoint End-to-End (Server) | Latency | The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply. | | | | Endpoint End-to-End (Server) | Memory Load | Windows-based Endpoint Agents submit collected Memory usage metrics. | ≤, ≥ | % | | Endpoint End-to-End (Server) | Packet Loss | The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets sent by the agent, then dividing by the number of packets sent, then multiplying by 100. | ≤, ≥ | % | | Endpoint Path Trace | Any Hop > ASN | Autonomous System Number assigned to a network prefix. | in, not in | | | Endpoint Path Trace | Any Hop > Delay | Estimated minimum transmission delay across a given link. The value is calculated by finding the agent that reported the lowest response time for the node on the right-hand side of the link (the node further from the agent), then subtracting the same agent's lowest detected response time for the node on the left-hand side of the link (the node closer to the agent). When a single path trace from a single agent traverses the link, this metric is called Delay. | ≤, ≥ | ms | | Endpoint Path Trace | Any Hop > IP Address | An IP address is a unique address that identifies a device on the internet or a local network. | in, not in | | | Endpoint Path Trace | Any Hop > MPLS Label | Label associated with a given MultiProtocol Label Switching network. | is, is not | empty | | Endpoint Path Trace | Any Hop > rDNS | Reverse DNS (rDNS or RDNS) is a Domain Name Service (DNS) lookup of a domain name from an IP address. | in, not in | | | Endpoint Path Trace | Hop # (source/destination) > ASN | Autonomous System Number assigned to a network prefix. | in, not in | | | Endpoint Path Trace | Hop # (source/destination) > Delay | Estimated minimum transmission delay across a given link. The value is calculated by finding the agent that reported the lowest response time for the node on the right-hand side of the link (the node further from the agent), then subtracting the same agent's lowest detected response time for the node on the left-hand side of the link (the node closer to the agent). When a single path trace from a single agent traverses the link, this metric is called Delay. | ≤, ≥ | ms | | Endpoint Path Trace | Hop # (source/destination) > IP Address | An IP address is a unique address that identifies a device on the internet or a local network. | in, not in | | | Endpoint Path Trace | Hop # (source/destination) > MPLS Label | Label associated with a given MultiProtocol Label Switching network. | is, is not | empty | | Endpoint Path Trace | Hop # (source/destination) > rDNS | Reverse DNS (rDNS or RDNS) is a Domain Name Service (DNS) lookup of a domain name from an IP address. | in, not in | | | Endpoint Path Trace | Path Length | Total number of hops of the path from source to target. | <, > | hops | | Endpoint Path Trace | Target IP Address | The IP Address a given test is targeting as determined by the DNS lookup if the test does not specify a specific IP Address. | in, not in | | | Endpoint Path Trace | Trace is Incomplete | Path does not reach its destination. | | | | Endpoint HTTP Server | Client SSL Alert Code | OpenSSL SSL error code. | is, is not | N/A, Unexpected Message (10), Bad Record MAC (20), Decryption Failed (21), Record Overflow (22), Decompression Failure (30), Handshake Failure (40), No Certificate (41), Bad Certificate (42), Unsupported Certificate (43), Certificate Revoked (44), Certificate Expired (45), Certificate Unknown (46), Illegal Parameter (47), Unknown CA (48), Access Denied (49), Decode Error (50), Decrypt Error (51), Export Restriction (60), Protocol Version (70), Insufficient Security (71), Internal Error (80), User Canceled (90), No Renegotiation (100), Unsupported Extension (110), Certificate Unobtainable (111), Unrecognized Name (112), Bad Certificate Status Response (113), Bad Certificate Hash Value (114), Unknown PSK Identity (115) | | Endpoint HTTP Server | Connect Time | The time required to establish a TCP connection with the web server. | | | | Endpoint HTTP Server | DNS Time | The time required for the agent to perform a DNS resolution of the hostname in the URL. | | | | Endpoint HTTP Server | Error | What, if any, errors occurred when the test was running. | matches, does not match, is present | n/a, [POSIX Extended Regular Expression Syntax](https://docs.thousandeyes.com/product-documentation/tests/http-server-tests/posix-extended-regular-expression-syntax) | | Endpoint HTTP Server | Error Type | A string from list of valid error types. | is, is not | Any, None, DNS, Connect, SSL, Send, Receive, HTTP, Content | | Endpoint HTTP Server | Receive Time | The time elapsed receiving the response from the server (time from first byte to last byte of payload). | | | | Endpoint HTTP Server | Redirect Count | Number of redirects from the target page. | ≤, ≥ | | | Endpoint HTTP Server | Response Code | The HTTP status code returned by the agent when fetching the URL. | is, is not | any error (≥ 400 or no response), OK (2xx), redirect (3xx), client error (4xx), server error (5xx), custom code | | Endpoint HTTP Server | Response Headers | Text match for response headers. | matches, does not match | | | Endpoint HTTP Server | Response Time | Also known as time-to-first-byte, this is the time from the beginning of the request (before DNS request) until the client receives the first byte of the response from the web server. | | | | Endpoint HTTP Server | Server SSL Alert Code | OpenSSL SSL error code. | is, is not | N/A, Unexpected Message (10), Bad Record MAC (20), Decryption Failed (21), Record Overflow (22), Decompression Failure (30), Handshake Failure (40), No Certificate (41), Bad Certificate (42), Unsupported Certificate (43), Certificate Revoked (44), Certificate Expired (45), Certificate Unknown (46), Illegal Parameter (47), Unknown CA (48), Access Denied (49), Decode Error (50), Decrypt Error (51), Export Restriction (60), Protocol Version (70), Insufficient Security (71), Internal Error (80), User Canceled (90), No Renegotiation (100), Unsupported Extension (110), Certificate Unobtainable (111), Unrecognized Name (112), Bad Certificate Status Response (113), Bad Certificate Hash Value (114), Unknown PSK Identity (115) | | Endpoint HTTP Server | SSL Negotiation Time | The time required to negotiate SSL/TLS. | | | | Endpoint HTTP Server | Throughput | This is the Wire Size divided by the Receive Time. | | | | Endpoint HTTP Server | Total Time | Time to perform the test, including DNS, Connect (when using TCP protocol), Redirects (if any), Register and Options phases of the test. | | | | Endpoint HTTP Server | Total Wire Size | The size of all the objects in the page while in transmission. Often, HTTP responses are compressed prior to transmission, so wire size may be less than actual size if any objects are compressed by the server. | <, > | kB | | Endpoint HTTP Server | Wait Time | The time elapsed between the completion of sending the HTTP request and the time the agent receives the first byte of the response from the web server. | | | ## Connected Devices Alerts ### Alert Type: Connected Devices | Alert Subtype | Metric | Metric Definition | Operators | Units/Values | | ----------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------ | | Connected Devices | Latency | The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply. | >, ≥ | ms | | Connected Devices | Packet Loss | The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets sent by the agent, then dividing by the number of packets sent, then multiplying by 100. | >, ≥ | % | | Connected Devices | Jitter | The mean deviation of latency. The mean deviation represents how far, on average, all measurements are from the mean of the data. | >, ≥ | ms | ## BGP Routing Alerts ### Alert Type: Routing Test Layer | Metric | Metric Definition | Operators | Units/Values | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ---------------------------------------- | | Reachability | The percentage of time during a round (currently 1 minute) in which the BGP router had a route to reach the destination prefix. | <, > | % | | Path Changes | The number of AS path changes during a round. If a route is withdrawn and re-announced, it counts as 2 changes. | <, > | changes | | Prefix | A number that identifies the network portion of an IP address. | in, not in | comma-separated list of covered prefixes | | Covered Prefix | Sub-prefixes contained in a specific prefix. | exists, in, not in | | | BGP Origin > ASN | The ASN in which the target IP resides. | not in, in | | | Any BGP Hop > ASN | Are any BGP ASNs found in a route. | not in, in | | | No BGP Hop > ASN | Are any BGP ASNs found in a route. | not in, in | | | BGP Hop # (origin, monitor) > ASN | Test the ASN of a specific BGP hop. | not in, in | | | RPKI Status | the validation result of a BGP route based on the Resource Public Key Infrastructure (RPKI) system, indicating whether the advertised route origin is authorized by the correct Autonomous System (AS) number | is | Valid, Invalid, NotFound | Only BGP routing tests provide covered prefix data. Do not assign a BGP alert rule with a covered prefix metric to a non-BGP test type that has BGP path visualization measurements enabled. For non-BGP test types, use an alert rule that does not include the covered prefix metric, and if needed create a separate BGP test and an a separate alert rule with the covered prefix metric. ## Device Alerts | Alert Type | Interface | Properties | Metric | Metric Definition | Operators | Units/Values | | ---------- | ---------------------- | --------------------------------------- | ------------------------------------- | -------------------------------------------------- | ---------------------------- | ------------------ | | Device | Any interface | | Throughput (either, in, out) | This is the Wire Size divided by the Receive Time. | ≥, >, ≤, < | Mbps, bps, kbps, % | | Device | Any interface | | Discards (either, in, out) | UDP packets arriving too late and thus discarded. | ≥, >, ≤, <) | pps, % | | Device | Any Interface | | Errors (either, in, out) | SNMP interface errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface | | Discards and Errors (either, in, out) | SNMP reported discards and errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface | | Operational Status | SNMP reported interface operational status. | Offline, Online | | | Device | Any Interface | | Admin Status | SNMP reported interface admin status. | Disabled, Enabled | | | Device | Any Interface | | State | SNMP reported interface state. | Unchanged, Changed | | | Device | Any Interface Matching | Interface Name (matches, doesn't match) | Throughput (either, in, out) | This is the Wire Size divided by the Receive Time. | ≥, >, ≤, < | Mbps, bps, kbps, % | | Device | Any Interface Matching | Interface Name (matches, doesn't match) | Discards (either, in, out) | UDP packets arriving too late and thus discarded. | ≥, >, ≤, <) | pps, % | | Device | Any Interface Matching | Interface Name (matches, doesn't match) | Errors (either, in, out) | SNMP interface errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Interface Name (matches, doesn't match) | Discards and Errors (either, in, out) | SNMP reported discards and errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Interface Name (matches, doesn't match) | Operational Status | SNMP reported interface operational status. | Online, Offline | | | Device | Any Interface Matching | Interface Name (matches, doesn't match) | Admin Status | SNMP reported interface admin status. | Disabled, Enabled | | | Device | Any Interface Matching | Interface Name (matches, doesn't match) | State | SNMP reported interface state. | Changed, Unchanged | | | Device | Any Interface Matching | Interface type | Throughput (either, in, out) | This is the Wire Size divided by the Receive Time. | ≥, >, ≤, < | Mbps, bps, kbps, % | | Device | Any Interface Matching | Interface type | Discards (either, in, out) | UDP packets arriving too late and thus discarded. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Interface type | Errors (either, in, out) | SNMP interface errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Interface type | Discards and Errors (either, in, out) | SNMP reported discards and errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Interface type | Operational status | SNMP reported interface operational status. | Offline, Online | | | Device | Any Interface Matching | Interface type | Admin status | SNMP reported interface admin status. | Disabled, Enabled | | | Device | Any Interface Matching | Interface type | State | SNMP reported interface state. | Changed, Unchanged | | | Device | Any Interface Matching | Excludes interfaces | Throughput (either, in, out) | This is the Wire Size divided by the Receive Time. | ≥, >, ≤, < | Mbps, bps, kbps, % | | Device | Any Interface Matching | Excludes interfaces | Discards (either, in, out) | UDP packets arriving too late and thus discarded. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Excludes interfaces | Errors (either, in, out) | SNMP interface errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Excludes interfaces | Discards and Errors (either, in, out) | SNMP reported discards and errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | Excludes interfaces | Operational status | SNMP reported interface operational status. | Offline, Online | | | Device | Any Interface Matching | Excludes interfaces | Admin Status | SNMP reported interface admin status. | Disabled, Enabled | | | Device | Any Interface Matching | Excludes interfaces | State | SNMP reported interface state. | Unchanged, Changed | | | Device | Any Interface Matching | IP address | Throughput (either, in, out) | This is the Wire Size divided by the Receive Time. | ≥, >, ≤, < | Mbps, bps, kbps, % | | Device | Any Interface Matching | IP address | Discards (either, in, out) | UDP packets arriving too late and thus discarded. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | IP address | Errors (either, in, out) | SNMP interface errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | IP address | Discards and Errors (either, in, out) | SNMP reported discards and errors. | ≥, >, ≤, < | pps, % | | Device | Any Interface Matching | IP address | Operational status | SNMP reported interface operational status. | Offline, Online | | | Device | Any Interface Matching | IP address | Admin status | SNMP reported interface admin status. | Disabled, Enabled | | | Device | Any Interface Matching | IP address | State | SNMP reported interface state. | Changed, Unchanged | | | Interface | | | Throughput | This is the Wire Size divided by the Receive Time. | either, in, out (≥, >, ≤, <) | Mbps, bps,kbps, % | | Interface | | | Discards | UDP packets arriving too late and thus discarded. | either, in, out (≥, >, ≤,<) | pps, % | | Interface | | | Errors | SNMP interface errors. | either, in, out (≥, >, ≤, <) | pps, % | | Interface | | | Discards and Errors | SNMP reported discards and errors. | either, in, out (≥, >, ≤, <) | pps, % | | Interface | | | State | SNMP reported interface state. | Changed, Ucnchanged | | ## Internet Insights Alerts | Alert Type | Metric | Metric Definition | Operators | Units/Values | | ------------------ | ------------------------- | ------------------------------------------------------ | ---------- | ------------ | | Application Outage | Affected Tests Count | Number of tests detecting an outage. | ≤, ≥ | | | Application Outage | Affected Domains | The domains detected in an outage. | in, not in | | | Application Outage | Affected Servers Count | Number of servers detecting an outage. | ≤, ≥ | | | Application Outage | Affected Applications | The applications detected in an outage. | in, not in | | | Application Outage | ASN | Autonomous System Number assigned to a network prefix. | in, not in | | | Application Outage | Outage Error Type | Error type detected in an outage. | in, not in | | | Application Outage | Server Locations | Server locations detected in an outage. | in, not in | | | Application Outage | Server Locations Count | Total server locations detected in an outage. | ≤, ≥ | | | Network Outage | Affected Tests Count | Number of tests detecting an outage. | ≤, ≥ | | | Network Outage | Affected Interfaces Count | Count of network interfaces detected in an outage. | ≤, ≥ | | | Network Outage | Affected Locations Count | Count of locations detected in an outage. | ≤, ≥ | | | Network Outage | Affected Domains | The domains detected in an outage. | in, not in | | | Network Outage | Locations | Locations detected in an outage. | in, not in | | | Network Outage | ASN | Autonomous System Number assigned to a network prefix. | in, not in | | ## WAN Insights Alerts | Alert Type | Metric | Metric Definition | Operators | Units/Values | | --------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------------ | | WAN Insights Quality | App Group | Application categories or classes are bundles of applications with similar traffic characteristics. | in, not in | | | WAN Insights Quality | Number of Users | Minimum/maximum number of active users on a site in order for it to be considered. | ≤, ≥ | | | WAN Insights Quality | Percentage | Site quality itself, expressed as a percentage. | ≤, ≥ | % | | WAN Insights Quality | Site ID | Use to restrict alerting to a particular site or set of sites. | in, not in | | | WAN Insights Capacity | Hostname | Use to focus on capacity conditions involving a particular hostname. | in, not in | | | WAN Insights Capacity | Interfaces | Choose one or more interfaces from the drop-down list with check boxes. | in, not in | | | WAN Insights Capacity | Percentile | Use to exclude outliers from your capacity alerts. Outliers represent conditions that may occasionally cause saturation events, but are not indicative of the most frequent or prevailing patterns of capacity utilization. | ≤, ≥, <, > | % | ## Cloud Insights Alerts | Alert Type | Metric | Metric Definition | Operators | Units/Values | | ------------ | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | ---------------- | | Traffic Flow | Connections Per Second | Sum of new TCP connections. | ≤, ≥ | cps | | Traffic Flow | Inside Cloud Throughput | The traffic throughput to remote endpoints that are within (inside) of your integrated/monitored AWS accounts. | ≤, ≥ | Gbps, Mbps, Kbps | | Traffic Flow | Outside Cloud Throughput | The traffic throughput to remote endpoints that are outside of your monitored AWS accounts (could be outside of AWS or in AWS but not monitored). Throughput filtered by the first node within the topology. | ≤, ≥ | Gbps, Mbps, Kbps | | Traffic Flow | Rejected Throughput | Sum of VPC Reject Actions. | ≤, ≥ | Gbps, Mbps, Kbps | | Traffic Flow | Total Throughput | Sum of VPC Accept Actions for traffic going to or coming from outside your provider. Limited to traffic going through the test ingress point in your provider. | ≤, ≥ | Gbps, Mbps, Kbps | ## Traffic Insights Alerts ### Alert Type: Traffic Flow | Scope Type | Metric | Metric Definition | Operators | Units/ Values | | ------------------------------------------- | ---------------------- | ------------------------------------------------------- | --------- | ---------------- | | Devices (for all interfaces and properties) | Connections Per Second | The total number of connections per second | ≤, ≥ | cps | | Devices (for all interfaces and properties) | Egress Throughput | The volume of traffic leaving your device | ≤, ≥ | Gbps, Mbps, Kbps | | Devices (for all interfaces and properties) | Ingress Throughput | The volume of traffic entering your device | ≤, ≥ | Gbps, Mbps, Kbps | | Devices (for all interfaces and properties) | Total Throughput | The total volume of traffic running through your device | ≤, ≥ | Gbps, Mbps, Kbps | | Applications, Subnet Tags, Geolocations | Connections Per Second | The total number of connections per second | ≤, ≥ | cps | | Applications, Subnet Tags, Geolocations | Egress Throughput | The volume of traffic leaving your device | ≤, ≥ | Gbps, Mbps, Kbps | | Applications, Subnet Tags, Geolocations | Ingress Throughput | The volume of traffic entering your device | ≤, ≥ | Gbps, Mbps, Kbps | | Applications, Subnet Tags, Geolocations | Total Throughput | The total volume of traffic running through your device | ≤, ≥ | Gbps, Mbps, Kbps | ## Event Detection Alerts ### Alert Type: Event Dectection | Metric | Metric Definition | Operators | Units/Values | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------ | | Event Impact | The impact level of the event (see [Event Impact Levels](https://docs.thousandeyes.com/product-documentation/event-detection#event-impact-levels)). | is, is not | High, Low, Medium | | Event Type | The type of event (see [Event Types](https://docs.thousandeyes.com/product-documentation/event-detection#event-types)). | is, is not | Local Network Issues, Network Issue, Network Outage, Proxy Issue, Server Issue | For some metrics, dynamic baselines can be configured. For more information, see [Dynamic Baselines](https://docs.thousandeyes.com/product-documentation/alerts/creating-and-editing-alert-rules/dynamic-baselines).