If any user runs more than ten jobs on a cluster and the same user has more than five jobs pending, then report the user as a rogue.

(any user has > 10 running apps) SAME (any user has > 5 pending jobs)

“rules”:[
   “SAME”:[
      {
         “scope”:”users”,
         “metric”:”appCount”,
         “operator”:”>”,
         “value”:10,
         state”:”running”
      },
      {
         “scope”:”users”,
         “metric”:”appCount”,
         “operator”:”>”,
         “value”:5,
         “state”:”pending”
      }
   ]
]

Internally the back end uses a clustering technique to implement the SAME operator. AutoActions runs all metric aggregations simultaneously. When the metrics are received and aggregated, it evaluates all rules and expressions. It starts at the evaluation tree's leaf expressions and goes up to the root expression.

Assume the above rule, three users (A, B, and C), and the following conditions

First, the two (2) simple rules are evaluated:

Second, it applies clustering by the scope, and for each cluster, it counts the number of rules triggered. In the back-end code, this procedure is called the “linking” of rules (see Ruleset.java).

Third, all groups with less than the needed links (2 in this case) are discarded. If some of the rules were triggered, that rule is reset for the group.

Finally, only the users that have triggered all rules remain.

User C meets the criteria for the Rogue User AutoAction. Therefore, User C triggers the AutoAction, and the alert is sent and/or the actions performed.

Both Users A and User C would have triggered the above rule were AND used instead of SAME, that is, (any user has > 10 running apps) AND (any user has > 5 pending jobs).

To achieve the same result as the above example using AND instead of SAME, you would need to create the following AutoAction rule for each and every user on the cluster: