Alert
Alert
You can create alerts that monitor metrics and send notifications. For example, you monitor the CPU usage and disk read/write of a Virtual Server, then send a notification to the user to handle the increased load.
Alert Policy
The alert policy can monitor metrics of the same Account and evaluate alerts for a single metric. This alert policy compares the specified threshold with metric conditions and sends a notification when the conditions are met.
If you disable the alert policy, its evaluation continues, but you can restrict sending alerts to the designated recipients. If you want to temporarily stop sending alerts for resources with an alarm policy configured, you can use alarm policy deactivation.
When you enable an alert policy, evaluation of the policy starts, and according to the configured conditions, the alert status changes to Alert, with a notification sent each time the alert status changes.
The alarm policy status indicates whether the alarm policy is enabled or disabled.
| Alert policy status | description |
|---|---|
| ● Active | In a state where the alert policy is enabled, notifications can be sent according to the configured conditions
|
| ● Inactive | Alert policy is disabled, and notification sending is restricted.
|
You can set alert stages in the alert policy. Depending on the alert stage, the alert color (red/pink/purple) is displayed differently, allowing visual distinction of stages by color. You can filter alarm policies by their alarm level and view policies for each level.
| Alert Level | description |
|---|---|
| High | When you set the step for the alarm policy condition to High, the alarm level is displayed in red. |
| Midle | If you set the stage to Middel in the alarm policy condition, the alarm stage is displayed in pink. |
| Low | If you set the stage to Middel in the alert policy condition, the alert stage is displayed in purple. |
Alert Status
The alarm state changes according to the alarm evaluation of the alarm policy. The alarm state is divided into three states: Normal (normal), Insufficient data (insufficient data), Alert (alert).
| Alarm status | description |
|---|---|
| ● Normal | Indicates a normal state that does not meet the conditions set in the alert policy
|
| ● Insufficient data | The alarm policy has just been created, the metric is unavailable, or there is insufficient data to determine the alarm state from the metric
|
| ● Alert | State that meets the conditions set in the alert policy
|
Alert Evaluation
| Term | description |
|---|---|
| Metric data point | Statistical data calculated from indicator data. Data points consist of a timestamp, collected statistical data, and the unit of the data
|
| Metric collection interval | Time interval for collecting metric data per service
|
| Alert evaluation cycle | The time interval for evaluating whether an alert meets the condition
|
| Alert Evaluation Scope | It is recommended to set the evaluation time range for alarm evaluation
|
| Alarm evaluation count / Alarm violation count | During the alarm evaluation interval, if the condition is satisfied for violation count out of evaluation count, the alarm state is switched to Alert
|
| Alert evaluation interval | Alarm evaluation range(seconds) X Alarm evaluation count |
For example, for a metric with a 1‑minute collection interval, if you set a 1‑minute evaluation window with 4 violations out of 5 evaluation attempts, the evaluation interval is 5 minutes. For a metric with a 5‑minute collection interval, if you set a 10‑minute evaluation window with 3 violations out of 3 evaluation attempts, the evaluation interval is 30 minutes.
| Category | Example 1 | Example 2 |
|---|---|---|
| Metric collection interval | 1 minute | 5 minutes |
| Alert evaluation cycle (fixed) | 1 minute | 1 minute |
| Alert Evaluation Scope | 1 minute | 10 minutes |
| Alarm evaluation count | 5 times | 3 times |
| Alarm violation count | 4th | 3 times |
| Alert evaluation interval (seconds) | 5 minutes (300 seconds) | 30 minutes (1,800 seconds) |
| Condition | If evaluated 5 times within 5 minutes and meets the condition 4 times, change the alarm state to Alert. | If evaluated three times within 30 minutes and the three-time condition is met, change the alarm state to Alert. |
Evaluation Scope
The evaluation scope of an alert policy is the time range used for alert evaluation.
- It is recommended to set it as the indicator’s collection interval or a multiple of the collection interval.
- You can enter up to 604,800 (7 days) seconds.
| Evaluation scope | Configurable evaluation count |
|---|---|
| 7 days (604,800 seconds) | 1 |
| 1 day (86,400 seconds) | 7 or less |
| 6 hours (21,600 seconds) | 28 or less |
| 1 hour (3,600 seconds) | 168 or less |
| 15 minutes (900 seconds) | 96 or less |
| 5 minutes (300 seconds) | 288 or less |
| 1 minute (60 seconds) | 1,440 or less |
There are the following limitations on the evaluation scope and the number of evaluations:
- When the evaluation range is at least 1 hour (3,600 seconds), the evaluation interval (evaluation count × evaluation range) can be up to 7 days (604,800 seconds).
- When the evaluation range is less than 1 hour (3,600 seconds), the evaluation interval (evaluation count × evaluation range) can be up to 1 day (86,400 seconds).
condition
The conditions for alarm evaluation require a conditional operator and threshold setting.
| Term | description |
|---|---|
| Statistics | Method for calculating metric data over the evaluation period for alert assessment |
| conditional operator | For alarm evaluation, after calculating metric data over the evaluation period, select the conditional operator to compare the value with the threshold. |
| threshold | For alarm evaluation, calculate the metric data over the evaluation range and then define a threshold to compare the values using conditional operators. |
When the namespace is Virtual Server and the metric is CPU Usage (unit: %), the alarm evaluation condition is completed as follows.
| Category | Example 1 | Example 2 |
|---|---|---|
| Metric collection interval | 1 minute | 5 minutes |
| Alert evaluation cycle (fixed) | 1 minute | 1 minute |
| Alert Evaluation Scope | 1 minute | 10 minutes |
| Alarm evaluation count | 5 times | 3 times |
| Alarm violation count | Round 4 | 3 times |
| Alert evaluation interval (seconds) | 5 minutes (300 seconds) | 30 minutes (1,800 seconds) |
| Statistics | average | Total |
| conditional operator | >= | < |
| threshold | 80 | 20 |
| Condition | If the average CPU Usage >= 80% for 4 occurrences over 5 minutes, change the alert status to Alert. | Change to < 20% 이면, 경보 상태를 Alert if the average CPU usage occurs three times within 30 minutes. |
Alert Notification
If the alarm evaluation criteria are met, change the alarm status to Alert and send a notification to the recipients configured in the alarm policy.
- Only users with a login history (users who have registered an email or mobile phone number) can be added as alert recipients.
- The notification reception method (E-mail or SMS) can be set on the Notification Settings page by selecting the notification target as Service > Alert.
- You can add up to 100 notification recipients.
- Users without login history cannot be designated as notification recipients.
- On the Notification Settings page, if you select the notification target as Service > Alarm but do not configure a notification delivery method, you will not receive notifications.
Method for handling missing data during alarm evaluation
Some resources may be unable to send metric data to ServiceWatch under certain conditions. For example, if a resource is inactive or does not exist, it will not be sent to ServiceWatch. If metrics are not collected for a certain period, the alert evaluation will change the alert status to Insufficient data.
ServiceWatch provides a way to handle missing data during alert evaluation. The methods for handling missing data are as follows:
- Ignore: maintains the current alarm state. (default)
- Missing: Treat missing data points as missing. If all data points within the evaluation range are missing, the alert status changes to
Insufficient data. - Breaching: Process missing data points as satisfying the threshold condition.
- Not breaching: Treat missing data points as normal when they do not satisfy the threshold condition.
- For alert policies created before the December 2025 release, missing data is handled with the default Ignore, and starting with the December 2025 release, you can directly select how to handle missing data.
- In the alert policy, the method for handling missing data can be modified, and from the time of modification onward, missing data will be processed using the updated method.
Alert History
The change history of the alarm status is recorded in the alarm history. The alarm history can be viewed for 30 days.