Policy Actions in Batch

You can configure a policy to execute its actions either:

  • Immediately for every triggering event.For example, if in a two-second period a policy matched 100 events, it would start its actions 100 times as soon as each event occurred.
  • Once a minute for all the events that triggered over the last minute. This is the batch option. The Execute actions in batch checkbox is selected by default.For example, if in a two-second period, a policy matched 100 events and then no triggering events occurred for the next 58 seconds, the policy would start each action just once. The context for the actions would be all 100 events.

Which you choose depends primarily on the type of action. For a notification action, it probably doesn't make sense to send 100 emails or SMS messages in a few seconds. In this case, it makes sense to batch the actions with a summary of the events occurring during the last minute. This can be easily accomplished using an email template that iterates through the event list. See the example in Predefined Templating Variables.

However, if the actions are thread dumps, there is no reason to expect that all 100 events are on the same node. They might be on different nodes. For that kind of action, you probably want the thread dump to be taken for each event and also, not to wait another 58 seconds before taking the thread dump.