Event Enrichment : Linux : High I/O Alert

silver surfer high io Event Enrichment : Linux : High I/O Alert

Here’s another addition to our real life Enrichment series; the High I/O threshold warning event.

Enhancements / Comments are welcome!

Name:

High I/O Alert

Escalation:

Send to SYS on call team  <= Add your escalation destination

Remediation:

NOTE: Use copy/paste to apply the commands shown after the “>>>” above in your SSH session.

SSH to samplehost.acme.com <== the host having the problem

>>> ssh samplehost.acme.com

verify disk io of samplehost.acme.com using:

>>> iostat -d -c 5

Linux 3.8.6-ubuntu-12-opt (turbo-srv) 02/26/2014 _x86_64_ (1 CPU)

avg-cpu: %user %nice %system %iowait %steal %idle
          0.36  0.00  0.08     0.11   0.00 99.45

Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn
vda      0.67 8.01     3.66     16532906 7546340
vdb      0.00 0.00     0.00       3231     424

record 10 iterations of iostat and send results to SYS on-call group

 


If you are interested in substantially cutting down on the time necessary to implement Event Enrichments, check out the new Event Enrichment Platform.

 

What's your opinion?