Threshold Alert

A threshold alert is the simplest and most common alert type. You define a metric, a comparison, a value and often a duration. When the condition holds, the alert fires, and when it clears, a recovery notice is sent.

Why it matters

Thresholds are easy to understand, explain and audit. They suit conditions with hard limits, like disk usage, certificate expiry or an error rate that is never acceptable. Their weakness is brittleness: values set too low produce noise, and values set too high miss real problems.

Example

alert: HighErrorRate
condition: 5xx responses / all responses > 0.05
for: 5 minutes
severity: critical

The "for" duration prevents a single spike from paging anyone. A second rule at 0.02 over 15 minutes can warn through chat without paging.

Common mistakes

• No duration, so one bad sample triggers the alert.
• Choosing thresholds by guesswork rather than from the baseline data.
• Using the same level for warnings and pages.
• Alerting on causes (CPU 80%) when no user impact exists.
• Forgetting a recovery condition with hysteresis, which causes flapping.

Related

• Alert
• Baseline
• Flapping
• Anomaly detection

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.