topic Re: Understand the custom event alert setting better in Alerting

Understand the custom event alert setting better

AK — Tue, 01 Jun 2021 13:00:05 GMT

Hello Folks,

Can someone explain me below statements with respect to "Custom event alert - threshold" setting

1. Raise an alert if the metric is above the threshold for 0 minutes during any 10 minute period.

2. Raise an alert if the metric is above the threshold for 5 minutes during any 10 minute period.

Regards,

Re: Understand the custom event alert setting better

JamesKitson — Fri, 04 Dec 2020 15:18:27 GMT

In the statement: Raise an alert if the metric is above the threshold for X during any Y minute period visualize the time series chart. On the chart there is a sliding window that is Y minutes large. If in that window at least X minutes have data points that are violating your threshold the event will be raised. That doesn't necessarily need to be consecutive minutes.

Then there are some restrictions on the fields that Dynatrace will warn you about if you try to use them. For example, the X value needs to be at least 1 and the Y value needs to be at least 3.

If your X value is 1 you're essentially saying raise the event as soon as a data point is collected in violation of the threshold and so the Y value is really having more of an effect on when the event will be closed.

Re: Understand the custom event alert setting better

ChadTurner — Fri, 04 Dec 2020 15:26:27 GMT

sure thing!

1.) Raise an alert if the metric is above the threshold for 0 minutes during any 10 minute period.

Depending on your metric, (We will use CPU %) Raise an alert if the CPU % is above the threshold for 0 minutes (Immediately) during any 10 min window.

This will give you an immediate alert - you can almost disregard the 10 mins window setting as you have it set to immediately alert.

2. Raise an alert if the metric is above the threshold for 5 minutes during any 10 minute period.

Depending on your metric, (We will use CPU %) Raise an alert if the CPU % is above the threshold for 5 minutes (must be active for 5 mins) during any 10 min window.

So this allows you to help limit small alert spikes. Lets say your CPU jumps over the threshold at 8am till 8:02am, then again at 8:04 till 8:06 - now you have used 4 mins of threshold violation, in 6 mins of elapsed time. If another cpu spike is detected prior to 8:10, then it will hit 5 mins of an issue still within your 10 min time period.

The time period allows you to reset the counter (the threshold counter)