Alert logic

Why a failing job sometimes pages you instantly and sometimes says nothing at all.

Four settings on the monitor decide whether a failure reaches a human:

json
{
  "failure_tolerance": 1,
  "schedule_tolerance": 1,
  "alert_surge_threshold": 10,
  "alert_enabled": true
}
{
  "failure_tolerance": 1,
  "schedule_tolerance": 1,
  "alert_surge_threshold": 10,
  "alert_enabled": true
}

Those are the defaults. As shipped, the first failure pages, and the eleventh consecutive alert stops paging for an hour.

Incidents are recorded regardless. Every setting on this page controls notifications, never whether the outage goes on the record.

What opens an incident#

ConditionIncident eventApplies to
No ping by the expected time plus grace_period_secondsMISSEDCron, Heartbeat
A failure ping, or a non-zero exit codeFAILEDAll job types
start with no finish inside max_duration_secondsFAILEDAll job types
Run finishes slower than max_duration_secondsDURATION_HIGHCron, Heartbeat, Event-driven
Run finishes faster than min_duration_secondsDURATION_LOWCron, Heartbeat, Event-driven
Three failed HTTP checks in a rowFAILEDUptime
Certificate crosses 30, 14, 7, or 1 day remainingSSL_EXPIRINGUptime

DURATION_HIGH, DURATION_LOW, and SSL_EXPIRING open an incident but leave the monitor UP. They are warnings, not outages.

Absorb transient failures with tolerance#

failure_tolerance is how many consecutive failure pings it takes before the monitor flips DOWN and the group is paged.

ValueBehaviour
1The first failure pages. The default
2One transient failure is absorbed. The second consecutive one pages
3Useful for jobs with known flakiness, such as a scraper hitting a rate limit

schedule_tolerance does the same for MISSED events on Cron and Heartbeat monitors: how many windows in a row can close empty before anyone hears about it.

Both counters reset to zero on the next success. They count consecutive failures, not failures in a period, so a job that fails every other run at failure_tolerance: 2 never pages at all.

Stop an alert storm#

A job stuck in a failure loop can produce an alert every minute. alert_surge_threshold caps it, at 10 consecutive alerts by default.

When the counter reaches the threshold, Drumbeats pauses paging for that monitor for one hour. Incidents keep being recorded and the timeline keeps filling in. Only the channel deliveries stop. After the hour, paging resumes if the monitor is still failing.

The counter resets to zero when the monitor recovers, so a fresh outage starts with a full budget.

Silence a monitor without deleting it#

Set alert_enabled to false and the monitor keeps evaluating, keeps recording incidents, and keeps its history, but never pages. Use it for a monitor you are still tuning, or one whose failures you are tracking without wanting to act on them yet.

To stop evaluation as well, pause the monitor instead. Paused monitors accept pings without judging them, which is what you want during planned maintenance.

Acknowledge to stop the nudging#

StateWhat happens next
OPENNew failure events in the same incident can page again, subject to surge protection
ACKNOWLEDGEDPaging pauses. Someone is on it. New failures still extend the timeline and still count toward the surge threshold
RESOLVEDClosed. The next outage opens a fresh incident with fresh counters

Acknowledge from the incident's Acknowledge button, or through the REST API. The states are OPEN, ACKNOWLEDGED, and RESOLVED, with no separate recovered state. Recovery is an INCIDENT_RECOVERY event carrying status: "RESOLVED".

What recovery does#

A success ping, or a passing check on an Uptime monitor, triggers all of this at once:

  1. The incident moves to RESOLVED.
  2. A recovery message goes to every channel that was originally paged.
  3. The monitor flips back to UP.
  4. The consecutive failure, miss, and alert counters reset to zero.

Keep recovery messages on. A team that only ever hears about failures has no signal to stand down, so someone keeps watching a dashboard for a job that recovered forty minutes ago.

What each message carries#

FieldIn the alertIn the recovery message
Monitor nameyesyes
Incident eventyesyes, the event that opened it
Timestampstarted atstarted at and resolved at
Outage durationnoyes
Link to the incidentyesyes
Payload previewfirst 200 characters on FAILEDno

Set the grace period wider than feels right#

A short grace_period_seconds is the leading cause of false MISSED alerts. A cron job scheduled at 02:00 that starts at 02:04 because the host was busy is not a failure, but a 60-second grace period says it is.

The default is 300 seconds. Start there. A late alert costs a few minutes. A false alert costs the team's trust in the whole system, and the first thing people do with an alert they do not trust is mute it.

Next#

Channels and groups for the delivery wiring this page assumes exists. Incidents for the lifecycle these rules act on. Monitor types for which tolerances apply to which type.