Create alert rules

An alert rule decides who hears about an alert. It matches alerts by severity, category, and endpoint, and sends a notification to the channels you choose. This page shows how to create a rule and add escalation steps, so the right person is told and a second person is told if nobody takes the alert.

A rule does not decide what counts as an alert. Thresholds such as disk space percentages and offline minutes are policy settings on the endpoint’s profile. See Alerts.

Until at least one rule exists, alerts are raised and recorded but nobody is notified.

Before you begin

• You need alert:manage. See Roles and permissions.
• Create at least one notification channel. A rule cannot be saved without one. See Notification channels.

How rules match

A rule covers an alert when all three of these are true:

• The alert’s severity is at or above the rule’s Minimum severity.
• The alert’s category is one of the rule’s Categories. With no category ticked, the rule covers every category.
• The alert’s endpoint is one of the rule’s Endpoints. With no endpoint chosen, the rule covers every endpoint.

Every enabled rule that covers an alert sends its notifications, so one alert can reach several channels through several rules. A channel that more than one rule names gets one message, not several. Escalation steps are different: an alert takes its steps from the first rule that covers it, in the order the Order column shows.

Some alerts belong to no endpoint, such as project budget alerts and most documentation reminders. Only a rule with no endpoints chosen covers them.

Disk alerts are raised per drive, not per endpoint, so an endpoint with two drives low on space raises two alerts and a rule sends a notification for each. See What disk, memory, and CPU alerts measure.

Create a rule

1. Select Alerts > Rules, then New rule. On the MSP plan, open the client first.
2. In Name, enter what the rule is for, such as “Critical disk to the on-call phone”.
3. Leave Enabled selected.
4. In Minimum severity, choose the lowest severity the rule covers: info and above, warning and above, or critical and above.
5. Under Categories, tick the categories the rule covers, or leave them all clear to cover every category.
6. Under Endpoints, search by hostname and tick the endpoints the rule covers, or leave none chosen to cover every endpoint.
7. Under Channels, tick at least one channel. These are told the moment an alert is raised.
8. Tell the same channels when the condition clears is selected by default and sends a message when the condition clears. For a PagerDuty channel, this is what resolves the PagerDuty incident. Clear it to send nothing on clear.
9. Select Save rule.

Add escalation steps

An escalation step tells more channels if nobody acknowledges the alert in time. Steps are optional.

1. Open the rule with Edit.
2. Under Escalation, select Add escalation step.
3. In After (minutes), enter how long after the alert was raised the step runs. Each step counts from when the alert was raised, not from the step before it.
4. Tick the channels the step notifies.
5. Repeat for each further step, then select Save rule.

When somebody acknowledges the alert, steps that have not run yet are skipped.

Turn a rule off or delete it

• To stop a rule without losing it, clear its Enabled checkbox in the list. The Switched off view lists every disabled rule.
• To delete a rule, select Delete, then confirm. Alerts it covered stop notifying anybody through it.

Verify

1. Select Alerts > Notification channels and select Test on each channel the rule uses. The Last result column shows Test message sent. when the channel works.
2. When an alert the rule covers is raised, open it. The Who was told card lists a notification for each channel.

If something goes wrong

Symptom	Cause	Fix
Nobody was notified about an alert	No enabled rule covers its severity, category, and endpoint.	Check the Switched off view, then widen a rule or add one.
A project or documentation alert notified nobody	The only matching rules choose specific endpoints.	Add a rule with no endpoints chosen for those categories.
A channel was notified but the message never arrived	The channel is disabled, or its address, URL, or key is wrong.	Test the channel. See Notification channels.

Next steps

• Notification channels
• Alerts