Alert
Alert
You can create alerts that monitor metrics and send notifications. For example, you monitor the CPU usage and disk read/write of a Virtual Server, then send a notification to the user to handle increased load.
Alert Policy
Alert policies can monitor metrics of the same Account and evaluate alerts for a single metric. These alert policies compare the specified threshold and metric conditions, and send notifications when the conditions are met.
If you disable the alert policy, the evaluation of the alert policy continues, but you can restrict sending alerts to designated recipients. If you want to temporarily stop sending alerts for resources with an alert policy set, you can use alert policy deactivation.
When you enable the alert policy, evaluation of the alert policy begins, and according to the set conditions, the alert status changes to Alert, and a notification is sent each time the alert status changes.
The alarm policy status allows you to check whether the alarm policy is enabled/disabled.
| Alert Policy Status | Description |
|---|---|
| ● Active | A state where the alarm policy is active and notifications can be sent according to the set conditions
|
| ● Inactive | The alarm policy is disabled, and notification sending is restricted
|
You can set alert levels for the alert policy. Depending on the alert level, the alert color (red/pink/purple) is expressed differently so that the levels can be visually distinguished by color. You can filter according to the alert policy’s alert level and retrieve the alert policy by each alert level.
| Alert Level | Description |
|---|---|
| High | If you set the step for the alarm policy condition to High, the alarm level is displayed in red |
| Midle | If you set the step to Middel in the alarm policy condition, the alarm step is displayed in pink |
| Low | If you set the step to Middel in the alarm policy condition, the alarm step is displayed in purple |
Alarm Status
Alert status changes according to the alert evaluation of the alert policy. Alert status is divided into three states: Normal (Normal), Insufficient data (Insufficient data), Alert (Alert).
| Alarm Status | Description |
|---|---|
| ● Normal | Means a normal state that does not meet the conditions set in the alarm policy
|
| ● Insufficient data | The alarm policy has just been created, or the metric is unavailable, or there is insufficient data to determine the alarm state from the metric
|
| ● Alert | State that meets the conditions set in the alert policy
|
Alert Evaluation
| Term | Description |
|---|---|
| Metric Data Point | Statistical data calculated from metric data. A data point consists of a timestamp, collected statistical data, and the unit of the data.
|
| Metric collection interval | Time interval for collecting metric data per service
|
| Alert Evaluation Interval | Time interval for evaluating whether the alert meets the conditions
|
| Alarm Evaluation Scope | Evaluation time range for alarm evaluation
|
| Alert Evaluation Count/Alert Violation Count | During the alert evaluation interval, if the condition is satisfied for violation count out of evaluation count, the alert status is switched to Alert
|
| Alarm evaluation interval | Alarm evaluation range(seconds) X Alarm evaluation count |
For example, for a metric with a 1-minute collection interval, if you set a 1-minute evaluation window with 4 violations out of 5 evaluation counts, the evaluation interval is 5 minutes. For a metric with a 5-minute collection interval, if you set a 10-minute evaluation window with 3 violations out of 3 evaluation counts, the evaluation interval is 30 minutes.
| Category | Example 1 | Example 2 |
|---|---|---|
| Metric collection interval | 1 minute | 5 minutes |
| Alarm evaluation cycle (fixed) | 1 minute | 1 minute |
| Alert Evaluation Scope | 1 minute | 10 minutes |
| Number of alarm evaluations | 5 times | 3 times |
| Number of alarm violations | 4 times | 3 times |
| Alarm evaluation interval (seconds) | 5 minutes (300 seconds) | 30 minutes (1,800 seconds) |
| Condition | If evaluated 5 times within 5 minutes and satisfies 4 conditions, change the alarm state to Alert | If evaluated 3 times within 30 minutes and satisfies 3 conditions, change the alarm state to Alert |
Evaluation Scope
The evaluation scope of the alarm policy is the evaluation time range for alarm evaluation.
- It is recommended to set it to the indicator’s collection interval or a multiple of the collection interval.
- You can input up to 604,800 (7 days) seconds.
| Evaluation Scope | Configurable number of evaluations |
|---|---|
| 7 days (604,800 seconds) | 1 |
| 1 day (86,400 seconds) | 7 or less |
| 6 hours (21,600 seconds) | 28 or less |
| 1 hour (3,600 seconds) | 168 or less |
| 15 minutes (900 seconds) | 96 or less |
| 5 minutes (300 seconds) | 288 or less |
| 1 minute (60 seconds) | 1,440 or less |
There are the following restrictions on the evaluation scope and the number of evaluations:
- When the evaluation range is 1 hour (3,600 seconds) or more, the evaluation interval (evaluation count × evaluation range) can be up to 7 days (604,800 seconds)
- When the evaluation range is less than 1 hour (3,600 seconds), the evaluation interval (evaluation count × evaluation range) can be up to 1 day (86,400 seconds).
Condition
The conditions for performing alarm evaluation require a conditional operator and threshold setting.
| Term | Description |
|---|---|
| Statistics | Method of calculating metric data during the evaluation period for alarm assessment |
| Conditional Operator | After calculating metric data over the evaluation period for alarm evaluation, select the conditional operator that compares the value with the threshold. |
| Threshold | Define a threshold to compare with the calculated metric data during the evaluation period for alarm assessment using a conditional operator |
If the namespace is Virtual Server and the metric is CPU Usage (unit: %), the alarm evaluation condition is completed as below.
| Category | Example 1 | Example 2 |
|---|---|---|
| Metric collection interval | 1 minute | 5 minutes |
| Alarm evaluation interval (fixed) | 1 minute | 1 minute |
| Alert Evaluation Scope | 1 minute | 10 minutes |
| Number of alarm evaluations | 5 times | 3 times |
| Alarm violation count | 4 times | 3 times |
| Alarm evaluation interval (seconds) | 5 minutes (300 seconds) | 30 minutes (1,800 seconds) |
| Statistics | Average | Total |
| conditional operator | >= | < |
| threshold | 80 | 20 |
| Condition | If the average CPU Usage >= 80% for 4 times over 5 minutes, change the alert status to Alert | If the average CPU Usage < 20% for 3 times over 30 minutes, change the alert status to Alert |
Alarm Notification
If the alarm evaluation conditions are met, change the alarm status to Alert and send a notification to the recipients set in the alarm policy.
- Only users with login history (users who have registered email or mobile phone number) can be added as alert recipients.
- Notification reception method (E-mail or SMS) can be set by selecting the notification target as Service > Alert on the Notification Settings page.
- Notification recipients can be added up to a maximum of 100.
- Users without login history cannot be designated as notification recipients.
- Notification Settings page, if you select the notification target Service > Alert and do not set the notification reception method, you cannot receive notifications.
Method for handling missing data during alarm evaluation
Some resources may not be able to send metric data to ServiceWatch under certain conditions. For example, if a specific resource is inactive or does not exist, it will not be sent to ServiceWatch. If metrics are not collected for a certain period, the alarm state will be changed to Insufficient data by the alarm evaluation.
ServiceWatch provides a way to handle missing data during alarm evaluation. The missing data handling methods are as follows:
- Ignore: Maintain the current alarm state. (default)
- Missing: Treat missing data points as missing. If all data points within the evaluation range are missing, the alarm state switches to
Insufficient datastate. - Breaching: Treat as satisfying the threshold condition for missing data points.
- Not breaching: Process as normal for missing data points that do not satisfy the threshold condition.
- For alert policies created before the December 2025 release, missing data is handled with the default Ignore, and from the December 2025 release onward, you can directly choose how to handle missing data.
- The method for handling missing data in the alarm policy can be modified, and from the point of modification, missing data will be processed using the changed method.
Alert History
The change history for alarm status is recorded in the alarm history. The alarm history can be viewed for 30 days.