Learn how to view alerts and how alerts trigger notifications and interact with events.

An alert defines the conditions under which metric values indicate a system problem and set of targets to be notified when the condition evaluates to true or false for a specified period of time. You express conditions using Wavefront Query Language expressions.

An alert fires when a metric reaches a value that indicates a problem.

To disable alert checking for a set of sources or alerts during a custom time window you can put them in a maintenance window or snooze alerts for a fixed time window.

Viewing Alerts

To view alerts, click the Alerts button or select Browse > Alerts. A list of alerts displays. Here is an example entry when the alert described in Tutorial: Getting Started fires:

Alert firing

Viewing Alert Details

To view alert details, click the icon in the State column. A chart displays with two queries:

  • <Alert name> - the alert condition.
  • Past Firings - an events() query that shows past firings of the alert.

For example, for the preceding alert, the chart displays:

Alert queries

Viewing Alert Firing

The Firings column shows how many times an alert changed into a firing state from non-firing in the last day, week, and month.

Searching Alerts

While some Wavefront instances can have hundreds of alerts, typical Wavefront users use a smaller subset of alerts each day. This makes the ability to quickly search for relevant alerts vital. Wavefront offers many features to help you organize and search for alerts.

Alert Events

As alerts fire, update, and resolve, events are created in Wavefront. You can optionally display such events as icons on a chart’s X-axis:

event icons

Alert Notifications

When an alert changes state, a notification containing alert information and a link to a chart is sent to targets listed in the alert’s Targets property.

For example, if you have configured an email address as the alert target, you will receive an email like the following:


whenever the alert fires, adds or removes an affected source, resolves, or is updated.

When you click the link in the notification, you see the following queries:

  • <Alert name> - the alert condition.
  • Alert Firings - an events() query that shows events of type alert for the alert. These are events when alerts are open and are resolved.
  • Alert Details - an events() query that shows events of type alert-detail for the alert. These are events when sources are failing or recovered.
  • Alert Data - a query for alert metrics.

Alert notification