4.2 End-User Experience Alert Rules
Configure alert rules that affect the end-user experience, such as CPU utilization, connectivity types (wired to wireless, Wi-Fi), browser behavior, and VPN
End-user experience metrics are mainly found in the Endpoint Agents alert rule set. Some relevant metrics are also available in Cloud and Enterprise Agent Web tests (Page Load and Transaction). These metrics, while not specific to end users, provide valuable insights into user experience. Transaction tests can execute an entire user flow, such as a login process, and repeat the flow each time the test runs. These results closely mirror the end-user experience.
Alert rule categories, structure, and condition concepts are covered in section 4.1.
Key areas monitored with ThousandEyes alert rules include:
- Local system performance
- Network tests and path trace
- Local network connectivity
- Application (HTTP scheduled tests) monitoring
- Browser experience
Meraki and Catalyst Center also offer options for configuring alerts related to end-user experience, such as monitoring VPN tunnels, wireless connectivity, and endpoint security events.
Example Alert Conditions
It is crucial for a network assurance engineer to understand the alerting capabilities of a specific platform, such as ThousandEyes Endpoint Agents. This section summarizes commonly alerted events and their configurations for each alert category. The tables below list the event types and their corresponding alert conditions.
Local System Performance Alert Conditions
Use this configuration to monitor the endpoint's CPU utilization or memory load. These can be found in the Real User Tests > Endpoint and Scheduled Tests > Endpoint End-to-End (server) alert types. It's important to alert on system-related metrics that might impact the overall user experience.
| Event | Condition |
|---|---|
| Endpoint performance | CPU utilization ≥ % |
| Endpoint performance | Memory load ≥ % |
Network Tests and Path Trace Alert Conditions
Use this configuration to monitor endpoint network performance metrics and the path to the destination. Alert conditions for metrics such as packet loss, latency, and jitter are available in all Endpoint Alert types. Path trace conditions are specific to Scheduled Tests > Endpoint Path Trace alert types.
| Event | Condition |
|---|---|
| End-to-End packet loss | ≥ % |
| End-to-End packet latency | ≥ ms |
| Path monitoring | Any Hop ASN in/not in ASN |
| Path monitoring | Path length > # |
Local Network Connectivity Alert Conditions
Use this configuration to monitor local network metrics. This alert condition is found within Real User Tests. Metrics include Connection Failures Count, Content Time, Error Count, Experience Score, Jitter, Latency, Packet Loss, Page Load Time, Response Time, and Signal Quality. Note that not all wireless metrics in the test views are available for alert rules.
| Event | Condition |
|---|---|
| Wifi monitoring | Signal Quality ≤ % |
Application Monitoring Alert Conditions
Use this configuration to monitor web pages or SaaS platforms relevant to end users. Application and network metrics can be correlated for root-cause analysis.
| Event | Condition |
|---|---|
| Application Monitoring | Response Time ≥ ms |
| Application Monitoring | Page Load Time ≥ % |
| Application Monitoring | Error count ≥ # |
| Network Monitoring | Packet Loss Time ≥ % |
| Network Monitoring | Latency ≥ ms |
Browser Experience Alert Conditions
Use this configuration to monitor metrics related to user browsing experience. These conditions are available for the Real User Tests alert type. For a comprehensive monitoring strategy, scheduled tests alert type can also be configured for other browsing experience metrics. Metrics from scheduled tests are derived from active monitoring, while metrics from real user tests come directly from the end user's browser interaction, representing passive monitoring.
| Event | Condition | Threshold |
|---|---|---|
| Connection Failures Count | Count Greater than (>) or Less than (<) | Number |
| Content Time | Number in milliseconds Greater than (>) or Less than (<) | Milliseconds |
| Error Count | Greater than (>) or Less than (<) | Number |
| Experience Score | Greater than (>) or Less than (<) | Percentage |
| Jitter | Greater than (>) or Less than (<) | Milliseconds |
| Latency | Greater than (>) or Less than (<) | Milliseconds |
| Packet Loss | Percentage Greater than (>) or Less than (<) | Percentage |
| Page Load Time | Greater than (>) or Less than (<) | Milliseconds |
| Response Time | Greater than (>) or Less than (<) | Milliseconds |
| Signal Quality | Greater than (>) or Less than (<) | Percentage |
Preparing for the Exam
- Configure alerts to notify on end-user experience
- Understand the different metrics collected by the Endpoint Agent and how these metrics are obtained
- Understand the difference between "All" and "Any" global configuration settings
Resources
Sample Questions
4.2 Question 1
Refer to the exhibit. A network engineer is tasked with configuring an alert that will trigger if the Endpoint Agent path ASN changes on a specific hop. What is the alert type and condition needed to meet the requirement?
- A) Scheduled tests, Hop#
- B) Real User Test, Hop#
- C) Scheduled tests, Any Hop
- D) Real User Test, Path Length
4.2 Question 2
A company is noticing sporadic slowdowns in their web application performance, impacting user experience. They suspect it might be related to high CPU utilization on employee laptops, potentially caused by background processes. Which ThousandEyes alert type and condition combination would be most effective in identifying if endpoint CPU performance is contributing to this issue?
- A) Real User Tests > Network Tests and Path Trace, End-to-End Packet Loss
- B) Scheduled Tests > Endpoint Path Trace, Path length > #
- C) Real User Tests > Endpoint, CPU utilization ≥ %
- D) Scheduled Tests > Endpoint End-to-End (server), Memory load ≥ %