Triggers - events that are defined by the user, for example: The CPU Utilization of the database machine is over 90%. Actions - the measures that the user defines for the system to take if a certain triggers (conditions) are met. Select Database(s) - allows you to choose one or more database instances to apply the rule to.

Trigger Types

  • Query pattern - the action(s) will be triggered when the current query matches the given query pattern.
  • Query Duration - the action(s) will be triggered when the current query duration is greater than the specified duration.
  • User(s) - the action(s) will be triggered when a user or users are connecting to the database.
  • IP(s) - The action(s) will be triggered when a host with a specific IP address connects to the database.
  • Database Name - The action(s) will be triggered when a certain database schema is accessed by a user.
  • Connection Utilization - The action(s) will be triggered when the connection utilization to a certain Database(s) exceeds a certain percentage.
  • Custom Script - The action(s) will be triggered when a custom script, provided by the user, runs and finds processes which will be killed by the system.

Trigger Operator Types

  • In - this operator is relevant to the Trigger types: User(s) and IP(s), and allows us to define a few IP addresses or Users that will trigger the action(s) defined.
  • Not In - similar to the operator In, but it is used for triggering an action when the IPs or Users are not included in the given list.
  • Like - this operator is relevant to the Trigger type: Query Pattern, and allows you to define a pattern using the % wildcard to match queries. The % wildcard represents any content in the query. Pattern matching is case-insensitive and semicolons are automatically removed. - Examples: \
    • select % from users; - matches any SELECT from users table
    • delete from %; - matches any DELETE without WHERE clause
    • update admin set %; - matches any UPDATE on admin table
  • Not Like - similar to the operator Like, but it is used for triggering an action when the given query pattern does not include the current query.
  • Is Greater Than - this operator is relevant to the Trigger type Query Duration.

Trigger Values

  • Query pattern - the string of the query pattern using % wildcard for matching any content. The system is case-insensitive and automatically removes semicolons before matching.
    • Use !@! to represent any content: select % from table_name;
    • Patterns must match query structure exactly (except case and semicolons)
  • Query Duration - the time above which the action will be triggered.
  • User(s) - a comma separated list of a User(s).
  • IP(s) - a comma separated list of IP(s).
  • Database Name - a comma separated list of name(s) of the relevant database schema(s).
  • Connection Utilization - a percentage value above which the action(s) will be triggered.
  • Custom Script - the relevant script.

Action Types

  • No Action - No action will be taken. Useful when only a notification is wanted.
  • Kill Query - Kill/cancel the specific query that matches the trigger pattern while keeping the database connection alive. Uses pg_cancel_backend for PostgreSQL and CALL mysql.rds_kill_query for MySQL.
  • Kill Connection - Terminate the entire database connection that matches the trigger pattern. Uses pg_terminate_backend for PostgreSQL and CALL mysql.rds_kill for MySQL.
  • Rate Limit - Limit the rate of a certain connection that match the trigger value.
  • Lock - Lock a certain User(s) or IP(s) etc’ out of the system.
  • Kill idle connections - All idle connection will be killed when the trigger value is matched.

Action Values

  • No Action - No value.
  • Kill Connection - No value.
  • Rate Limit - Limit the resources of the current request request to a defined based on the trigger type and value. All requests above the limit will be ignored.
  • Lock - No value.
  • Kill idle connections - No value.

Examples

Scout Rules List

Triggers and Actions

Kill long Queries

Triggers and Actions