Interval Detection¶

In the selected time range, the system will perform anomaly detection on Metrics data. If the proportion of mutation anomalies in the detected data points exceeds the preset threshold percentage, an interval anomaly event will be triggered.

Use Cases¶

Applied to monitor data/Metrics with stable trends. For example, detecting that the proportion of abnormal mutation data points in the host CPU usage in the last 1 day exceeds 10%, an anomaly event will be generated.

Configuration¶

Detection Frequency¶

The execution frequency of the detection rule, automatically matching the selected detection interval.

Detection Interval¶

The time range for querying Metrics each time the task is executed.

Detection Metrics¶

The Metrics data being monitored.

Cross-Workspace Query Metrics¶

After authorization, you can select detection Metrics from other workspaces under the current account. After the monitor rule is successfully created, cross-workspace alert configuration can be achieved.

Trigger Conditions¶

Set the trigger conditions for alert levels: You can configure any one of emergency, important, warning, and normal trigger conditions. Supports three forms of data comparison: upward (data increase), downward (data decrease), and upward or downward.

Configure the trigger conditions and severity. When the query result is multiple values, any value that meets the trigger condition will generate an event.

For more details, refer to Event Level Description.

Bulk Alert Protection¶

Enabled by default.

When the number of alerts generated in a single detection exceeds the preset threshold, the system will automatically switch to the status summary strategy: instead of processing each alert object individually, a small number of summary alerts will be generated based on the event status and pushed.

This ensures the timeliness of notifications and significantly reduces alert noise, avoiding the risk of timeout due to processing too many alerts.

Alert Levels¶

1. Alert Levels Emergency (red), Important (orange), Warning (yellow): Based on the configured condition judgment operators.

2. Alert Level Normal (green): Based on the configured detection count, explained as follows:

   • Each execution of a detection task counts as 1 detection, e.g., Detection Frequency = 5 minutes, then 1 detection = 5 minutes;

   • The detection count can be customized, e.g., Detection Frequency = 5 minutes, then 3 detections = 15 minutes.

   Level

   Description

   Normal

   After the detection rule takes effect, if emergency, important, or warning anomaly events are generated, and the data detection result returns to normal within the configured custom detection count, a recovery alert event will be generated. ❗️ Recovery alert events are not restricted by Alert Silence. If the recovery alert event detection count is not set, the alert event will not recover and will always appear in the Events > Unrecovered Events List.

Data Gaps¶

For data gap status, seven strategies can be configured.

1. Link the detection interval time range, judge the query result of the detection Metrics in the most recent minutes, do not trigger events;

2. Link the detection interval time range, judge the query result of the detection Metrics in the most recent minutes, the query result is considered as 0; at this time, the query result will be re-compared with the threshold configured in the Trigger Conditions above to determine whether to trigger an anomaly event.

3. Custom fill the detection interval value, trigger data gap events, trigger emergency events, trigger important events, trigger warning events, and trigger recovery events; when selecting this type of configuration strategy, the custom data gap time configuration is recommended to be >= the detection interval time interval. If the configured time <= the detection interval time interval, there may be situations where both data gap and anomaly conditions are met. In this case, only the data gap processing result will be applied.

Information Generation¶

When this option is enabled, the detection results that do not match the above trigger conditions will generate "information" events.

Other Configurations¶

For more details, refer to Rule Configuration.