APM Metric Detection¶

Data scope: Trace (T), used to monitor key APM metric data in the workspace. The system counts the number of traces that meet the conditions within the specified time period. When the count exceeds the custom threshold, an anomaly event is triggered.

Detection Configuration¶

Detection Frequency¶

Set the time interval at which detection is executed.

• Preset options: 1 minute, 5 minutes, 10 minutes, 15 minutes, 30 minutes, 1 hour

• Crontab mode: Click “Switch to Crontab mode” to configure a custom schedule. Scheduled task execution can be configured with periods based on seconds, minutes, hours, days, months, and weeks.

Detection Range¶

Set the time range of data queried for each detection. (❗️The detection range must be greater than or equal to the detection frequency and must match the actual data reporting interval to avoid missed detections or false alarms.)

• Custom format: Enter a custom detection range, for example: 20m (last 20 minutes), 2h (last 2 hours), 1d (last 1 day).

Detection Metrics¶

Set the metrics used for detection. Two detection modes are supported:

• Service metrics

• Trace statistics

Service Metrics¶

Monitor the Application Performance Monitoring (APM) services in the current workspace.

Trace Statistics¶

Count the number of traces (Spans) that meet the conditions within the specified time period. When the count exceeds the custom threshold, an anomaly event is triggered. This mode can be used to notify about anomalies and errors in service traces.

Trigger Conditions¶

Configure the trigger conditions and severity levels. When the query returns multiple values, an event is generated if any value meets the trigger condition.

Four threshold levels are supported: Fatal, Critical, Important, and Warning, as well as a Normal recovery condition.

For more details, see Event Level Description.

Advanced Options¶

Consecutive Trigger Evaluation¶

When enabled, an event is generated only when the trigger condition is continuously met, preventing false alarms caused by transient fluctuations. (❗️The maximum configurable limit is 10.)

Bulk Alert Protection¶

Enabled by default.

When the number of alerts generated by a single detection exceeds the preset threshold, the system automatically switches to a status-based aggregation strategy: instead of processing each alert target individually, it generates and pushes a small number of summary alerts based on event status.

This ensures timely notifications while significantly reducing alert noise and avoiding the risk of timeouts caused by processing too many alerts.

When this toggle is enabled, the event details generated after the monitor detects an anomaly will not display history records or related events.

Recovery Conditions¶

Configure the recovery conditions and severity levels. When the query returns multiple values, a recovery event is generated if any value meets the trigger condition.

Set independent recovery thresholds for different levels to enable tiered recovery. For example, a Critical alert recovers only when the value drops below 70, while an Important alert can recover when the value drops below 80.

Data Gap¶

Strategy for handling empty query results within the detection range:

When trigger conditions, data gap handling, and information generation are configured together, the triggering priority is evaluated as follows: Data gap > Trigger condition > Information event generation.

That is: first determine whether a data gap exists, then determine whether the threshold is triggered, and finally determine whether an information event is generated.

Information Generation¶

When this option is enabled, you must configure the information generation condition. The system writes an "Info" event only when the detection result does not trigger any of the "Fatal", "Critical", "Important", or "Warning" thresholds and the information generation condition is met.

This is suitable for scenarios where normal status changes or low-priority information need to be recorded.

Next Steps¶

After completing the detection configuration above, continue with the following configuration:

1. Event Notification: Define the event title, content, notification members, data gap handling, and linked incidents;
2. Alert Configuration: Select the alert policy, and configure notification targets and mute periods;
3. Link: Link a dashboard for quick navigation to view data;
4. Permissions: Set operation permissions to control who can edit or delete this monitor.