FAQ¶

Can monitors be shared with others?

Yes.

In the Monitor List, you can share monitors through the export and import functions.

How should I understand the "event attributes" in Mute Rules?

When a monitor generates an anomaly event, it sends an alert notification. In this case, alert muting based on the event dimension is supported:

When configuring a Mute Rule, you can set event attributes, i.e., assign labels to the current Mute Rule. For example, if hosts A, B, C, and D all generate anomaly events, but you don't want to receive alert notifications from host C, you can enter host:C in the event attributes. When the monitor captures an anomaly event alert, it will filter based on the configured attributes and only send alert notifications for hosts A, B, and D.

Why does the configured 3-minute no-data alert frequently trigger false alarms?

If you use a Monitor rule of the type "Infrastructure Survival Detection", the current TrueWatch determines whether an infrastructure object is alive by checking the reporting (or update) time of its data. For example, if the reporting frequency of an infrastructure object is once every 5 minutes, this means the data update interval is 5 minutes. If in this scenario you configure the detection frequency to once every 1 minute and set the rule to "trigger an alert after 3 minutes without data", alerts that don't match expectations may be falsely triggered.

For scenarios with such a high detection frequency, it is recommended to use metric data with a higher reporting frequency for survival detection. This requirement can currently be met by configuring Threshold Detection.

When configuring an Alert Policy, how do you configure multiple filter conditions for one rule?

Only one set of filter conditions can be added under a single rule, but you can add multiple key:value matching filter rules within the filter conditions. Simply click the input field of the filter rule to add multiple conditions. After adding them, click the input field to view the rules.

Label: When creating a Monitor, I add the {{df_label}} variable to the event content, but the df_label label is empty in the final event records generated by this Monitor.

The df_label in Events > Content Details > Extended Fields is a system field. When a variable added in Monitor > Event Content conflicts with this system field, the variable is discarded, and only the df_label field under the event is finally displayed.