Docs » Detectors and Alerts » Using Built-in Alert Conditions » Static Threshold

Static Threshold

What this alert condition does

Alerts when a signal goes above or below a static threshold, or is within or outside of a range.

When to use this alert condition

Use this condition when you need to be alerted based on fixed values, as opposed to trends (for which you could use the Sudden Change and Resource Running Out conditions) or comparisons with past behavior (for which you could use Historical Anomaly). This condition works best with metrics that have a static range of “good” and “bad” values.

To compare one signal with another, use Custom Threshold.

Examples

  • You have an availability SLA of 99.9, and want to be alerted whenever your availability drops below that value.
  • You have a latency signal with a “healthy” range between 200 and 300 ms, and want to be alerted when it goes outside that range.

Settings

PARAMETER VALUES USAGE NOTES
Alert when Above, Below, Out of Range, Within Range none

Threshold

Lower threshold, Upper threshold

Number Lower and upper thresholds are available if you choose Out of Range or Within Range for Alert when.
Trigger sensitivity Immediately, Duration, Percent of duration

Immediately triggers an alert as soon as the threshold is met.

Duration triggers when the signal meets and remains at threshold condition for a specified period, such as 10 minutes. If it is normal for a signal to rise and fall rapidly, using this option reduces flappiness. If this option is used, an alert will not trigger if there are any missing datapoints during the duration. For more information, see Specifying how quickly to trigger an alert.

Percent of duration triggers based on the number of datapoints that met the threshold during the specified duration. For more information, see Specifying how quickly to trigger an alert.

Duration Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w The amount of time the signal must meet the threshold condition. Longer time periods result in lower sensitivity and potentially fewer alerts.
Percent of duration Percentage: Integer between 1 and 100; Duration: Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w The percentage of anomalous datapoints received during the specified duration.

Specifying how quickly to trigger an alert

As you might expect, choosing Immediately for Trigger Sensitivity means that an alert will be triggered as soon as the signal meets the threshold. This option is the most sensitive (may trigger the most alerts) of the three trigger sensitivity options.

Depending on the nature of your signal, triggering alerts immediately can lead to flappiness. In these cases, you can choose one of the other options, Duration or Percent of duration.

The Duration option triggers when the signal meets and remains at threshold condition for a specified period, such as 10 minutes. Therefore, using this option is less sensitive (may trigger fewer alerts) than the Immediately option. If you use this option, an alert will not be triggered if any datapoints are delayed or do not arrive at all during that time range, even if all the datapoints that are received do meet the threshold. (For more information about delayed or missing datapoints, see Handling delayed or missing datapoints.)

If you want an option that could trigger even if some datapoints do not arrive on time, use Percent of duration (with a percentage below 100).

The Percent of duration option triggers alerts based on the number of datapoints that met the threshold during the window, compared to how many datapoints were expected to arrive. Because this option triggers an alert based on the percentage of datapoints that met the threshold, it can sometimes trigger an alert even if some datapoints didn’t arrive on time. Therefore, using this option with a percentage below 100 is more sensitive (may trigger more alerts) than the Duration option.

The following examples illustrate how alerts would be triggered in various situations.

Example 1

  • Option you specify for Trigger Sensitivity: Duration = 3 minutes

  • Resolution of the signal: 5 seconds

  • Number of datapoints expected in 3 minutes: 12 per minute * 3 minutes (36)

  • Number of anomalous datapoints (how many times the threshold must be met) to trigger alert: 36

    Total datapoints expected Total datapoints received Anomalous datapoints required Anomalous datapoints received Alert is triggered?
    36 36 36 36 Yes
    36 36 36 35 or fewer No
    36 35 36 35 or fewer No

Example 2

  • Option you specify for Trigger Sensitivity: Percent of Duration = 75% of 3 minutes

  • Resolution of the signal: 5 seconds

  • Number of datapoints expected in 3 minutes: 12 per minute * 3 minutes (36)

  • Number of anomalous datapoints (how many times the threshold must be met) to trigger alert: 75% of 36 (27)

    Total datapoints expected Total datapoints received Anomalous datapoints required Anomalous datapoints received Alert is triggered?
    36 36 27 27-36 Yes
    36 30 27 27-30 Yes
    36 30 27 26 or fewer No

    Note that in the last example above, even if 26 anomalous datapoints arrive, and 26/30 is greater than the 75% you specified, the required number of anomalous datapoints (27) did not arrive. Therefore, the alert will not be triggered. The percent you specify represents percent of expected datapoints, not percent of received datapoints.

API usage note

If you use the SignalFx v2 API to build detectors, you can use the const() function to specify different threshold values for different dimension values. For example, you might have different acceptable SLA values depending on whether a host is in dev, lab, or production. Using the const() function can be more efficient than manually building multiple detectors or detectors with multiple rules. For more information, see Generating multiple timeseries in the SignalFx API documentation.