APM Metrics Detection¶

Data Range: Traces (T), used to monitor key APM Metrics data in the workspace. The system counts the number of traces that meet the conditions within a specified time period, and triggers an anomaly event when the custom threshold is exceeded.

Detection Configuration¶

Detection Frequency¶

Set the time period for executing detections.

• Preset options: 1 minute, 5 minutes, 10 minutes, 15 minutes, 30 minutes, 1 hour

• Crontab mode: Click "Switch to Crontab mode" to configure custom periods, supporting scheduled task execution based on seconds, minutes, hours, days, months, weeks, etc.

Detection Interval¶

Set the data time range for each detection query (❗️The detection interval should be greater than or equal to the detection frequency, and must match the actual data reporting cycle to avoid missed detections or false alarms).

• Custom format: Manually enter the detection interval, e.g., 20m (last 20 minutes), 2h (last 2 hours), 1d (last 1 day).

Detection Metrics¶

Set the metrics for detection data, supporting two detection modes:

• Service Metrics

• Trace Statistics

Service Metrics¶

Monitor APM services in the current workspace.

Trace Statistics¶

Count the number of spans that meet the conditions within a specified time period, and trigger an anomaly event when the custom threshold is exceeded. This can be used for notifications of service trace anomaly errors.

Trigger Conditions¶

Configure trigger conditions and severity levels. When the query result has multiple values, an event is generated if any value meets the trigger condition.

Supports configuring four levels of thresholds: Critical, Error, Warning, Info, and OK recovery conditions.

For more details, refer to Event Level Description.

Advanced Options¶

Continuous Trigger Judgment¶

When enabled, events are generated only when the trigger condition is continuously met, avoiding false alarms due to transient fluctuations (❗️The maximum configuration limit is 10 times).

High Volume Alert Protection¶

Enabled by default.

When the number of alerts generated by a single detection exceeds the preset threshold, the system automatically switches to a summary strategy by status: Instead of processing each alert object individually, it generates a small number of summary alerts based on event status and pushes them.

This ensures timely notifications while significantly reducing alert noise and avoiding timeout risks due to processing too many alerts.

When this switch is enabled, subsequent event details generated by the monitor after detecting anomalies will not display historical records or related events.

Recovery Conditions¶

Configure recovery conditions and severity levels. When the query result has multiple values, a recovery event is generated if any value meets the trigger condition.

Set independent recovery thresholds for different levels to achieve degraded recovery. For example, a critical alert recovers when the value drops below 70, while a warning alert recovers when below 80.

Data Gap¶

Handling strategy when the detection metric query result is empty within the detection interval:

When trigger conditions, data gap, and information generation are configured simultaneously, the priority is: Data Gap > Trigger Conditions > Information Event Generation.

That is: first determine if there is a data gap, then determine if the threshold is triggered, and finally determine whether to generate an information event.

Information Generation¶

When this option is enabled, you need to configure Information Generation Conditions. The system writes an "Info" event only when the detection result does not trigger any of the "Critical", "Error", "Warning", or "Info" thresholds and meets the information generation conditions.

It is suitable for scenarios where normal state changes or low-priority information needs to be recorded.

Subsequent Configuration¶

After completing the above detection configuration, continue to configure:

1. Event Notification: Define event title, content, notification members, data gap handling, and related incidents;
2. Alert Configuration: Select alert strategies, set notification targets, and mute periods;
3. Association: Link dashboards for quick navigation to view data;
4. Permissions: Set operation permissions to control who can edit/delete this monitor.