Alert rules live under Settings → Alert Rules. Three tabs: Rules, Notifications (routing policies), and Silences.
Start with Standard Alerts
Before writing custom rules, review the built-in presets — each is a single toggle with a threshold slider and optional routing policy. Highlights:
- Disk filling up — forecast-based: fires when disk usage is predicted to reach 90% of capacity within 24 hours
- Memory breach predicted — forecast ≥95% within 12 hours
- High memory / CPU load — sustained-threshold rules (e.g. memory >90% for 10 minutes)
- Any strong anomaly — Ntuition anomalies ≥4σ, with correlated-incident suppression on
- Correlated incident — fires when ≥3 anomalies cluster into one incident
- Log errors, path latency, network throughput, and others
For many teams the presets plus one or two custom rules cover the whole estate.
Custom rules
A rule is: what to watch, when it's bad, and who to tell.
What to watch — Signal Type:
metric— pick a Metric Name (autocomplete from your catalog) and an Aggregation (avg/sum/min/max/count)log— a Search Pattern such aserror|exception|fataltrace— a Service Name- Ntuition Anomaly — optional metric prefix and host filter; threshold is Min deviation (σ). Leave "Suppress anomalies covered by a correlated incident" checked so one incident doesn't page you per-symptom.
- Ntuition Incident — threshold is Min correlated anomalies
- Ntuition Forecast — pick the metric, direction ("rises to"/"falls to"), threshold, and horizon
When it's bad — Condition: comparator (>, ≥, <, ≤, =), threshold, and for duration — instantly, or sustained for 1/5/10/15 minutes. Sustained durations kill flappy alerts; use "instantly" only for genuinely binary conditions.
Who to tell: attach a Notification Policy (reusable routing defined on the Notifications tab) or pick channels directly — webhooks, Slack, a named integration, or a recipient group. Two more knobs matter for on-call quality of life: Re-notify while firing (once, or on an interval) and Escalate if still firing after a set time.
Silences
Planned maintenance? Add a silence scoped by rule, severity, or target, with a duration and a comment. Prefer silences over disabling rules — they expire on their own.