Alert Rules

An alert rule describes what to watch, when that is a problem, and how bad a problem it is. You manage rules under Monitoring > Alert rules.

The alert rules page with the list of rules on the left and the rule editor on the right

The list groups rules by the part of the Platform they watch: Framework, Axon Server, Usage & Limits and Workspace. The icon color is the rule’s highest severity, gray for a disabled rule, and the badge shows how many alerts the rule has right now, pending or triggered.

Click Add alert to create a rule, or select a rule to edit it. Every workspace starts with the default rules.

What it watches

The What it watches section of the rule editor
Scope

The type of subject the rule watches, such as handlers, processors, or Axon Server disks. You choose it when you create the rule and cannot change it afterwards; to watch something else, create a new rule.

Scope filters

Narrow the rule down to the subjects you care about, based on their properties: the application name, the processor name, the message type, and so on. A filter can match a value exactly (equals, not equals), one of a comma-separated list (any of, none of), or a pattern with * as a wildcard (like, not like). Pattern matching ignores case. When you add several filters, a subject must match all of them.

Preview matching subjects lists the subjects the rule currently covers, so you can check your filters before saving.

Split inbox by

Decides how fired alerts are grouped into inbox items. Left empty, all alerts of the rule in one environment end up in a single inbox item. Choose one or more properties to get a separate item per distinct value—for example, split by application name to get one item per application. Each item is snoozed, archived, and notified about on its own.

When it fires

The When it fires section of a rule with several conditions, exceptions and tiered thresholds

A rule has one or more conditions. The rule fires for a subject when any of its conditions holds for that subject.

Each condition consists of:

Metric

What to measure, such as latency, error rate or free disk space. The metrics available depend on the scope; see Subjects and Metrics.

Comparison and threshold

For example > 250 ms. Durations can be entered in milliseconds, seconds, minutes, hours, or days.

Percentile

For timing metrics, which reading to judge: the minimum, the median, the ninetieth percentile, the ninety-fifth percentile, or the maximum. The ninetieth percentile is a good default: it ignores the occasional outlier but still catches a slow tail.

Severity

Critical, Major, Minor or Info. The severity decides the priority of the inbox item and which integrations are notified.

Tiered thresholds

You can add several conditions on the same metric with different thresholds and severities. The default Bad performing aggregate rule, for example, reports an event stream size above 100 as Info, above 250 as Minor, and above 500 as Major. An alert always carries the highest severity of the conditions that hold, so it escalates and de-escalates as the value moves.

Exceptions

Under each condition, + Add exception lets you use a different threshold for specific subjects or environments, or stop alerting on them. See Exceptions.

Warm up and cool down

The Warm up and cool down and Where it applies sections of the rule editor
Alert after

How many minutes a condition must hold before the alert triggers. Until then the alert is pending: you can see it on the rule and on the subject, but no inbox item opens and nobody is notified. This filters out short spikes.

Resolve after

How many minutes the subject must stay healthy before the alert resolves. If the problem returns within that time, the alert simply continues. This prevents a flapping subject from opening and closing the same item over and over.

Only judge while handling

For message-driven subjects such as handlers, aggregates, and entities, the minimum number of messages per minute before the rule judges a subject. A latency measured over two messages says little; set this to ignore quiet periods. Throughput conditions are always judged.

Warm up and cool down do not apply to workspace subjects such as access tokens and credits; those alerts trigger and resolve on the first check.

Where it applies

All environments

The rule applies to every environment in the workspace, including environments you create later.

Specific

The rule applies only to the environments you select.

Workspace subjects do not belong to an environment, so rules on them have no environment selection.

Managing rules

Enabled

Turn a rule off without losing it. A disabled rule is not checked, and its firing alerts resolve.

Previous versions

Every saved change creates a new version. Previous versions lists them with who made the change and when. Select a version to load it into the editor, then save to restore it.

The previous versions of a rule
Delete

Removes the rule. Inbox items it already opened are kept.

Reset to default

Replaces all rules in the workspace with the default rules. Rules that already match a default are kept, missing defaults are added, and every other rule—including rules you created yourself—is removed. Inbox items are kept.

Changes take effect from the next check, about a minute after you save. Editing a rule does not resolve its firing alerts or close its inbox items; they are judged against the new thresholds from then on. Changing Split inbox by while alerts are firing regroups them: the editor asks you to confirm, firing subjects move to new items, and the old items are closed.

Rule details

Besides Configuration, a rule has three tabs that show what it has been doing.

Active alerts

One row per subject the rule is firing or pending on, with the measured and worst values.

The Active alerts tab of a rule
Inbox items

Every inbox item the rule has opened, in any status, and the rule version it opened under.

The Inbox items tab of a rule
Alert history

One row per alert in the last 30 days, from the moment the subject started breaching, through triggering, to recovery.

The Alert history tab of a rule