About time series monitoring
If you've set up a time series monitoring job to receive alerts for breaches to set thresholds, the monitoring checks the time series every 5 minutes and sends emails for every breach. However, several breaches are merged into one email if the time period you've set in Minimum duration is less than the merge interval time. The merge interval time is the minimum time difference between breaches for combining the breach notifications into one email. Currently, this is the same value as you set for Minimum duration. A buffer time of 5 minutes is subtracted from each monitoring job's start time to make sure it overlaps with the previous job.
Avoid alert flooding by setting a minimum duration of, for instance, 5 minutes.
Here's an example of how emails are triggered. Note that activation interval refers to Minimum duration.
-
First scenario: The threshold is breached twice for a period longer than the minimum duration. In this monitoring job, the time interval between the two breaches is larger than the merge interval time. These breaches aren't merged, and users receive two emails.
-
Second scenario: The threshold is breached twice for a period longer than the minimum duration. The time interval between the last breach in the previous monitoring job and the first breach in the current monitoring job is higher than the merge interval time. These emails aren't merged, and users receive two emails.
-
Third scenario: The threshold is breached twice, but there's no time interval between the last breach in the previous monitoring job and the first breach in the current monitoring job. These emails are merged, and users receive one email.
-
Fourth scenario: The threshold is breached once and the time interval between the previous breach and current breach is lower than the merge interval. These emails are merged and users don't receive any emails for this monitoring job.
Examples
These are examples of how threshold values trigger emails:
Example 1
- Threshold value = 0
- Threshold type = above
- Minimal duration value = 5 min.
Explanation: The time series value continuously exceeds the threshold. Only one email is generated since there is only one continuous breach.
Example 2
- Threshold value = 0.5
- Threshold type = above
- Minimal duration value = 3 min
Explanation: The time series value has breached the threshold twice. The merge interval is 3 minutes, while the time interval between breaches is 30 minutes. These emails aren't merged, and users receive two emails.
Example 3
- Threshold value = 0.5
- Threshold type = below
- Minimal duration value = 5 min
Explanation: Three time series values breach the threshold. However, due to the set values, these time series only breach the threshold for 1 minute. This is less than the minimal duration value. Since the time series has a frequency larger than the minimal duration and merge interval, the emails aren't merged.