Gateway Health

Template gateway-health@1, writer role, in the reserved collection gateway: a Gateway Health playbook lists exactly "collections": ["gateway"] and needs no context model. The views pack ships a disabled example, Artekis/GatewayHealth (daily at 06:00 over 24 h): add outputs.email, enable it. Its thresholds are playbook params:

Family	Flagged when (default)	Param
log-burst	a logger's busiest 10-minute bucket of ERROR + WARN lines reaches the minimum and the multiple of its mean in the previous run	burstMinPer10Min 20, burstRatio 5, maxLogEvents 200,000
script-error	ERROR lines from the platform's script loggers (ScriptTask, Scripting., tags.eventscripts, perspective.actions.script)	scriptErrorMin 1, scriptLoggers
sf-backlog	a Store and Forward engine with quarantined rows, dropped rows up since the previous run, or pending rows at or over the minimum and rising	sfPendingMin 10,000
connection	an enabled database connection not VALID, an enabled OPC connection not CONNECTED	:
device	an enabled device not Connected	:
quality	a tag provider's bad-quality count up by at least the minimum and percentage since the previous run	qualityMinTags 10, qualityMinPercent 5, maxQualityTags 20,000

Which projects a playbook reads (for a gateway shared by several projects). By default a Gateway Health playbook reads the whole gateway: every project's log events and the gateway's own. Three more params narrow it:

Param	Default	Effect
projectsInclude	[]	only log events that belong to one of these projects
projectsExclude	[]	every project's log events except these (not together with projectsInclude)
gatewayEvents	true	false leaves out log events that belong to no project, and the sf-backlog, connection, device and quality families

For example, a demo that should show only its own project: "projectsInclude": ["Demo"], "gatewayEvents": false; a project still in development left out: "projectsExclude": ["NewLine"]. Project names compare without case. A log event belongs to the project its log context names (a Perspective script error and a failing named query carry project-name), else to the project in a failing gateway script's line (Error executing timer script: <Project>/<Name>, which carries no context), else to every project of this gateway named as a whole word in its logger or message; an event naming no project belongs to the gateway. With gatewayEvents off, the Findings page (showing every collection or gateway) and the Gateway Health digest carry the line "Gateway-wide health is not shown here." Both lists set, a blank name, a list that is not a list or a gatewayEvents that is not true or false is refused when the playbook is saved, naming the param. The run's KPIs carry scope: the settings and logEventsLeftOut. A narrowed run does not resolve an open finding it did not look at: with gatewayEvents off a Store and Forward, connection, device or quality finding stays as it is, and so does a failing script's finding in a project outside the scope; a log burst still resolves when a run no longer sees it. A log burst is compared with the previous run's counts, so change a playbook's scope between runs only knowing that its next burst check compares with counts read under the old scope.

A burst's finding states how many times the previous run's mean the burst was ("about 144 times, worked from the mean as printed") next to the limit (at least 5 times, the playbook's burstRatio). If the model's text contradicts that (it quotes the limit as the measurement), Artekis drops the model's version, lists the drop on the status page as rule V9, and files the analyzer's own wording for the burst instead.

Every candidate is a configuration finding with no proposed change. The first run records the baseline and reports no regression and no log burst (an install's own restart sits in its window, and a burst needs a previous run to be one; its KPIs count the bursts it held in burstsHeldForBaseline); it still reports script errors, quarantined Store and Forward data, and connections and devices that are down. Each later run compares with the newest earlier DONE run of the playbook. A run whose window holds a gateway restart leaves the 10 minutes after the start out of the log-burst count (KPIs gatewayStartedAt, restartInWindow, restartLines; script errors in those minutes still count), so the start's own WARN storm is not a burst. A Store and Forward quarantine that grew across a restart while nothing was dropped says so in its reasons: the shutdown stores in-flight rows and the start forwards them again, so the quarantined rows are usually duplicates of stored ones: check one against the history table before discarding. log-burst and script-error findings never depend on the writer: a candidate of either family that the writer leaves out, or that fails validation, is stored with the analyzer's own text at confidence 0.6, and a writer finding on one below 0.6 is stored at 0.6, so a counted burst or a failing script is always an open finding (at most 50 such analyzer findings per run, largest first; the other four families stay the writer's call). The quality check reads only the tag providers the policy allows and never the [Artekis] provider. The Gateway Health digest opens with the model's run summary, which groups findings that share a cause (Alarm Health digests list the findings only). A 19,900-tag provider's health run took 16–19 s end to end. Checks of the module's own static configuration (the "MRI" categories) are a separate offline service, not part of this playbook.