Frequently Asked Questions¶
Can monitors be shared with others?
Yes.
In the Monitor List, you can share monitors through the export or import functions.
How to understand [Event Attributes] in mute rules?
When a monitor generates an anomaly event, it sends an alert notification. At this point, you can mute alerts based on event dimensions:
When setting up a mute rule, you can configure event attributes, which means setting labels for the current mute rule. For example, if four hosts A, B, C, and D all generate anomaly events, but you do not want to receive alert notifications from host C, you can fill in host:C in the event attributes. Then, when the monitor captures an anomaly event alert, it will filter based on the configured attributes and only send alert notifications for hosts A, B, and D.
Why does the "3 minutes no data alert" configuration frequently trigger false alarms?
If you are using a monitor rule of the "Infrastructure Liveness Detection" type, the current Guance determines whether an infrastructure object is alive by detecting the reporting (or update time) of its data. For example, if the reporting frequency of an infrastructure object is once every 5 minutes, this means the data update interval is 5 minutes. If you configure the detection frequency to once every 1 minute in this scenario and set a rule of "triggering an alert if there is no data for 3 minutes," it may incorrectly trigger alerts that do not meet expectations.
For such scenarios with high detection frequency, it is recommended to prioritize using metric data with higher reporting frequencies for liveness detection. Currently, you can achieve this by configuring Threshold Detection.
When configuring an alert strategy, how can I configure multiple filter conditions for one rule?
Only one set of filter conditions can be added under one rule, but multiple filter rules with key:value matching can be added within the filter conditions. Therefore, simply click the input field of the filter rule to add multiple conditions. After adding, click the input field to view the rules.
Labels: When creating a monitor, the {df_label} variable is added to the event content, but the event records generated by this monitor ultimately have an empty df_label tag.
The df_label in Event > Content Details > Extended Fields is a system field. When the variable added in Monitor > Event Content conflicts with this system field, it will be discarded, and only the df_label field under the event will be displayed.