From a5f9bc605b422febe0d70cd89528f42dd10ababb Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Mon, 3 Feb 2025 19:04:35 -0800 Subject: [PATCH 01/15] DOCS-674 - Static log monitor frequency evaluation --- docs/alerts/monitors/alert-grouping.md | 6 +-- docs/alerts/monitors/create-monitor.md | 39 ++++++++++++------ docs/alerts/monitors/overview.md | 4 +- .../config-resolution-window-logs.png | Bin 0 -> 52548 bytes ...g => config-resolution-window-metrics.png} | Bin .../alerts/monitors/logs-static-missing.png | Bin 29163 -> 51262 bytes .../img/alerts/monitors/logs-trigger-type.png | Bin 55765 -> 60465 bytes static/img/alerts/monitors/setup-logs.png | Bin 171238 -> 137417 bytes .../alerts/monitors/show-estimated-scan.png | Bin 0 -> 183159 bytes 9 files changed, 31 insertions(+), 18 deletions(-) create mode 100644 static/img/alerts/monitors/config-resolution-window-logs.png rename static/img/alerts/monitors/{config-resolution-window-2.png => config-resolution-window-metrics.png} (100%) create mode 100644 static/img/alerts/monitors/show-estimated-scan.png diff --git a/docs/alerts/monitors/alert-grouping.md b/docs/alerts/monitors/alert-grouping.md index 7a47634c46..458df3a301 100644 --- a/docs/alerts/monitors/alert-grouping.md +++ b/docs/alerts/monitors/alert-grouping.md @@ -20,7 +20,7 @@ Alert grouping works for both logs and metrics monitors. ### Metrics -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. 2. Click **Add a New monitor**. 3. Select **Metrics** as the type of monitor. 4. Enter your metrics query, then select your desired alert grouping option. @@ -32,7 +32,7 @@ Alert grouping works for both logs and metrics monitors. ### Logs -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**. 2. Click **Add a New monitor**. 3. Select **Logs** as the type of monitor. 4. Enter your logs query, then select your desired alert grouping option: @@ -40,8 +40,6 @@ Alert grouping works for both logs and metrics monitors. * **One alert per [group]**. Allows you to receive one notification per each unique value of the grouping field(s). You can pick more than one field for the grouping condition. In the example below, you would receive one alert for each `service` that has error count greater than 50. The input field has an auto-completion dropdown that allows you to select all the applicable fields from your query.
setup-logs.png 5. Configure the rest of your alert condition per standard procedure. Refer to [Monitors](/docs/alerts/monitors) for more details. -The input field has an auto-completion dropdown that allows you to select all the applicable fields from your query. - ## Set a Muting Schedule for an alert group Optionally, you can apply a Muting Schedule to your alert group. [Learn more](/docs/alerts/monitors/muting-schedules/#set-a-muting-schedule-for-an-alert-group). diff --git a/docs/alerts/monitors/create-monitor.md b/docs/alerts/monitors/create-monitor.md index e8d5d7130f..2d0ec4fb8a 100644 --- a/docs/alerts/monitors/create-monitor.md +++ b/docs/alerts/monitors/create-monitor.md @@ -166,13 +166,20 @@ You can set a logs monitor trigger to alert based on the following: Triggers are evaluated by balancing the requirement of timely alert notifications while ensuring that monitor data is indeed available to evaluate trigger conditions. -* For [static logs monitors](#static-detection-method), triggers are similar to "Alert when the result is greater than _ within Y Minutes". The triggers are evaluated periodically as below. - | When detection window (Y) is | Evaluate trigger every | - |:-----------------------------|:-----------------------| - | 15m or less | 1m | - | 15m to 1h | 2m | - | 1h to 6h | 10m | - | Greater than 6h | 20m | +* For [static logs monitors](#static-detection-method), you can control trigger monitor evaluation frequency using the options below. If `Alert when result is than <_> within . Evaluate trigger every .`: + | When detection window (X) is | Evaluate trigger every (Y) | + |:-----|:-----------------------| + | 2m | 1m, 2m | + | 5m | 1m, 2m, 5m | + | 10m | 1m, 2m, 5m, 10m | + | 15m | 1m, 2m, 5m, 10m | + | 30m | 2m, 5m, 10m, 20m | + | 1h | 2m, 5m, 10m, 20m | + | 3h | 10m, 20m, 40m, 1h | + | 6h | 10m, 20m, 40m, 1h | + | 12h | 20m, 40m, 1h | + | 24h | 20m, 40m, 1h | + | 7d | 20m, 40m, 1h | * For [anomaly logs monitors](#anomaly-detection-method), triggers are evaluated every `timeslice` as specified in the monitor query. For example, the below query is evaluated every 2 minutes. ``` _sourceCategory=Labs/Apache/Access @@ -187,7 +194,7 @@ Triggers are evaluated by balancing the requirement of timely alert notification When configuring monitor trigger conditions, you can set a resolution window to resolve alerts quickly once the underlying issue is fixed. The resolution window specifies how long a monitor will wait before resolving an alert after the issue is corrected. -For example, if your monitor evaluates the last 1 hour, you can set a resolution window of 15 minutes. Once the resolution window is continuously satisfied for 15 minutes, the alert will resolve automatically.
config-resolution-window +For example, if your monitor evaluates the last 1 Hour, you can set a resolution window of 15 Minutes. Once the resolution window is continuously satisfied for 15 Minutes, the alert will resolve automatically.
config-resolution-window #### Static detection method @@ -195,13 +202,18 @@ For example, if your monitor evaluates the last 1 hour, you can set a resolution logs trigger type.png -`Alert when result is within