Create alert condition based on a custom event

Hi, I created a custom event “LoginAttempt” with custom attributes “loginEmail”, “loginSucceeded”. I would like to create an Alert that is triggered for each user that try to login 3 times in a 5 minutes window.

I tried to use this NRQL:
SELECT count(*) FROM LoginAttempt FACET loginEmail WHERE appName = 'my-app' AND loginSucceeded is FALSE

The critical threshold is reached but it never open incident? Can someone help me with this use case please?

Hi, @maxime.morin: Can you please post a link to the alert policy containing the above condition? Only New Relic personnel will be able to access the link.

1 Like[accountId]=2516053&pane=eyJuZXJkbGV0SWQiOiJhbGVydGluZy11aS1jbGFzc2ljLnBvbGljaWVzIiwibmF2IjoiUG9saWNpZXMiLCJwb2xpY3lJZCI6IjExNzcyOTUifQ&sidebars[0]=eyJuZXJkbGV0SWQiOiJucmFpLm5hdmlnYXRpb24tYmFyIiwibmF2IjoiUG9saWNpZXMifQ


@philweber any idea why it doesn’t work?

I notice your threshold is, “when the query returns a value above 2 at least once in 1 minute”. That means a user would have to have 3 or more failed logins within the same minute. Maybe try increasing the threshold to a larger window, like 5 minutes?

1 Like

Thanks, weird it seems that it was already working, maybe it didn’t open any incident since the condition was already in violation when I saved my changes.

Anyway, it works now.
Thank you for the support and have a nice day

1 Like

Glad to hear that @maxime.morin! Let us know if anything comes up.