Abnormal IB Operation Volume

Abnormal IB Operation Volume Alert

Alert ID: ib_operation_volume Category: Integration Broker

What This Alert Detects

This alert detects when the volume of IB async operation instances (PSAPMSGPUBHDR) is significantly higher than the rolling historical average.

A sudden volume spike may indicate a runaway integration sending messages in a loop, an upstream system retrying failed messages, or an unusually large but legitimate batch publish event.

How Baselining Works

psLens maintains a rolling history of up to 288 volume snapshots (approximately 24 hours at a 5-minute check interval). Each check cycle records the current message count for the lookback window.

Once at least 6 baseline snapshots have accumulated, the alert begins comparing the current count against the historical average. This prevents false alerts during the first few minutes after psLens starts.

Severity Logic

For example, with the default threshold of 50%:

• Current count is 75% above average → Warning
• Current count is 100%+ above average → Critical

Configuration

alerts:
  checks:
    ib_operation_volume:
      enabled: true
      lookbackHours: 1         # Window for counting current messages
      thresholdCount: 50       # Percentage increase to trigger Warning

Alert Details

Each alert item includes:

• Current message count for the lookback window
• Historical average count
• Percentage increase above average
• Number of baseline samples used
• Link to the IB Monitor page

How to Respond

1. Navigate to the IB Monitor in psLens to see which operations are generating the volume
2. Check if any operations are in Error or Stalled status (see related IB alerts)
3. Review the specific operations with high message counts to determine if the volume is expected
4. If a runaway integration is identified, investigate the upstream system sending the messages
5. Consider using the Daily IB Volume report to review historical patterns

Tables Queried