If any user is running more than ten jobs on a cluster and the same user has more than five jobs pending then report the user as rogue.

(any user has > 10 running apps) SAME (any user has > 5 pending jobs)

“rules”:[
   “SAME”:[
      {
         “scope”:”users”,
         “metric”:”appCount”,
         “operator”:”>”,
         “value”:10,
         state”:”running”
      },
      {
         “scope”:”users”,
         “metric”:”appCount”,
         “operator”:”>”,
         “value”:5,
         “state”:”pending”
      }
   ]
]

Internally the back-end uses a clustering technique to implement the SAME operator. AutoActions runs all metric aggregations simultaneously. When the metrics are received and aggregated it then evaluates all rules and expressions. It starts at the evaluation tree's leaf expressions and works its way up to the root expression.

Assume the above rule, three users (A, B, and C), and the following conditions

First, the two (2) simple rules are evaluated:

Second, it applies clustering by scope and for each cluster it counts the number rules triggered. In the back-end code this procedure is called “linking” of rules (see Ruleset.java).

Third, all groups with less than the needed number of links (2 in this case) are discarded. If some of the rules were triggered, that rule is reset for the group.

Finally, only the users that have triggered all rules remain.

User C meets the criteria for the Rogue User AutoAction, therefore User C triggers the AutoAction and the alert is sent and/or the actions performed.

Both User A and User C would have triggered the above rule were AND used instead of SAME, that is, (any user has > 10 running apps) AND (any user has > 5 pending jobs).

To achieve the same result as the above example using AND instead of SAME, you would need to create the following AutoAction rule for each and every user on the cluster: