05 Jun 2025
09:02 AM
- last edited on
09 Jun 2025
08:55 AM
by
MaciejNeumann
Hi,
In our Alerting Profile, the "Problem send delay in minutes" has been increased from 0 to 30 minutes. This is intended to reduce noise by delaying notifications for short-lived problems.
We also use log-based custom event extraction to monitor feed delays. In these custom events, we've configured the property dt.event.timeout to 180 minutes (3 hours) to control how long the event remains open before automatically closing if no new matching logs arrive.
My questions are:
With the alerting profile set to a 30-minute "Problem send delay" and dt.event.timeout configured to 180 minutes, does Dynatrace:
We have noticed some false alerts caused by old log entries (e.g., a log with a timestamp from several weeks ago triggered an incident recently). Our current matcher filters based on phrases and log source but does not filter logs based on their timestamp.
Is there a recommended way to add timestamp validation in log event extraction so that alerts only trigger on recent log entries?
06 Jun 2025 07:48 AM
Hi @Nadeesh
Alerting Profile time configuration related to when add the AP to the problem after problem mark as open.
Time out of event related to the marking the problem as closed after this period of time.
Once the AP is added to the problem you can use it for problem notification.
Regarding old time stamp, wonder if your ingest mechanism configure right to use the timestamp because of the 24 hours limitation on timestamp
HTH
Yos