Docs · Operate

Rules and alerts

Rules turn accepted observations into deterministic alert lifecycles. They are deliberately separate from notification delivery and incidents.

A simple threshold

post: laptop
signal: cpu.percent
condition: greater than 85 for 300 seconds
severity: warning

Open Rules, select the post, choose CPU, memory, or disk usage, set the threshold and duration, and decide what missing data means. Requiring five minutes above 85% avoids firing on a short spike. A matching good-quality observation advances the alert lifecycle; later evidence clears it according to the rule contract.

Quality and freshness

A value of zero, a missing value, a stale sample, and a collector failure are different facts. Rules must decide explicitly which qualities they accept.

Acknowledgement

Acknowledgement records that an operator has seen an alert. It does not suppress collection, resolve the underlying condition, or erase the original evidence.

Notifications

Notification routes are separately configured delivery policies. Provider failure does not roll back an alert; retries and delivery outcomes remain visible.

From alert to incident

Create an incident when several alerts or evidence records belong to one operational episode—for example, a deployment followed by database saturation and elevated API latency.