Frequently Asked Questions¶
Can monitors be shared with others?
Yes.
In the Monitor List, you can share monitors through the export and import features.
How to understand the "Event Attributes" in mute rules?
When a monitor generates an anomaly event, it sends an alert notification. At this point, you can mute alerts based on the event dimension:
When setting a mute rule, you can configure event attributes, which means setting labels for the current mute rule. For example, if four hosts A, B, C, and D all generate anomaly events, but you do not want to receive alert notifications from host C, you can fill in host:C in the event attributes. In this case, when the monitor captures an anomaly event alert, it will filter based on the configured attributes and only send alert notifications for hosts A, B, and D.
Why does a "3-minute no data" alert configuration frequently trigger false alarms?
If you are using a monitor rule of the "Infrastructure Liveness Detection" type, Guance determines whether an infrastructure object is alive by detecting the reporting (or update time) of its data. For example, if the reporting frequency of a known infrastructure object is once every 5 minutes, this means the data update interval is 5 minutes. If you configure the detection frequency to once every 1 minute and set a rule to "trigger an alert if there is no data for 3 minutes" in this scenario, it may incorrectly trigger unexpected alerts.
For such scenarios with high detection frequency, it is recommended to prioritize using metric data with a higher reporting frequency for liveness detection. Currently, you can configure Threshold Detection to meet related requirements.
When configuring an alert strategy, how to configure multiple filter conditions for one rule?
Only one set of filter conditions can be added under a single rule, but multiple key:value matching filter rules can be added within that filter condition set. Therefore, you just need to click the input field of the filter rule to add multiple conditions. After adding them, click the input field to view the rules.
Labels: When creating a monitor, the {{df_label}} variable is added in the event content, but in the final event records generated by this monitor, the content of this label df_label is empty.
The df_label in Event > Content Details > Extended Fields is a system field. When the variable added in Monitor > Event Content conflicts with this system field, it will be discarded, and only the df_label field under the event will be displayed in the end.