Add a Monitor
This document shows you how to create a monitor.
- Go to the Monitors page by clicking Manage Data > Monitoring > Monitors.
- Click on the Add button > New Monitor to add a new Monitor. The creation dialog box will appear.
- You can configure Sumo Logic Monitors using Terraform modules.
- Select a Monitor Type, either Logs or Metrics.
- Select a Detection Method, either Static or Outlier.
- Static allows you to set specific threshold conditions. Use this detection method when you are alerting on KPIs that have well defined and constant thresholds for what's good and bad. For example, infrastructure metrics like CPU utilization, and memory.
- An Outlier is an unusual change or a spike in a time series of a key indicator. Use this detection method when you are alerting on KPIs that don't have well-defined constant thresholds for what's good and bad. You want the Monitor to automatically detect and alert on unusual changes or spikes on the alerting query. For example, application KPIs like page request, throughput, and latency.
- Provide a Query. Provide a Query. Logs Monitors can have one query up to 4,000 characters long. For Metrics Monitors, you can specify up to six queries. When providing multiple metrics queries, use the letter labels to reference a query row. The Monitor will automatically detect the query that triggers your alert, and will mark that row with a notification bell icon. See joined metrics queries for details.
- Outlier detection methods require you to select the Direction you want to track. If you chose Static, you won't see this option.
- Up. Only get alerted if there is an abnormal increase in the tracked key indicator.
- Down. Only get alerted if there is an abnormal decrease in the tracked key indicator.
- Both. Get alerted if there is any abnormality in the data whether an increase or a decrease.
- Specify the Trigger Type. A Monitor can have one critical, warning, and missing data trigger condition, each with one or more notification destinations. Triggers have different options depending on the query and alert type. Click the Expand button next to the query type you're using for configuration details.
Logs Trigger Types (expand to view)
Metrics Trigger Types (expand to view)
(Optional) Additional Settings
- Alert Name: Alert Name allows you to customize the name that appears on the Alert Page. By default, the Alert name is the monitor name, but you may want to create a custom name based on your use case. You can include any of the available alert variables, except
{{AlertName}},Playbook,{{AlertResponseURL}}, and{{ResultsJson}}, in the name such as the type of monitor or trigger condition. You can check the alert variables list for details.- Example:
{{Resultsjson.Env}}- High CPU. This alert will produce an Alert with the name like PROD - High CPU. Here we are assuming that there is a field name Env in underlying data that has a value of "PROD".
- Example:
- Evaluation Delay: Collection delays may occur due to your environment and it takes a couple of minutes for data to be processed into Sumo Logic. Since Monitors run on data from the most current time period, it's possible for Monitors to evaluate against incomplete data. As a result, Monitors can generate false positives or negatives that can cause confusion. Set an evaluation delay in seconds to delay the evaluation of a Monitor, so it doesn't look at the most current time (where data can be incomplete) and instead looks at an older period of time, where you have more complete data.
If your data is coming from the Amazon CloudWatch Source for Metrics we recommend a setting of 900 seconds.
- Alert Name: Alert Name allows you to customize the name that appears on the Alert Page. By default, the Alert name is the monitor name, but you may want to create a custom name based on your use case. You can include any of the available alert variables, except
(Optional) Set Notifications: When a trigger condition is met you can send notifications to other people and services. To add notifications click on the Add Notification button. You can add more than one notification channel for a Monitor.
Metrics Monitors have an option to send notifications either as a group or separately. Group Notifications define whether you want single notifications per time series that match the Monitor query or you want group notifications where you receive a single notification for the entire Monitor. Log Monitors always group notifications.
- The Connection Type specifies the notification channel where you want to get notified, such as an email or webhook. See Connections for details. Monitor notifications support variables to reference its configuration settings or your raw data. See alert variables for a table of the available variables.
- Email: Provide 1-100 recipient email addresses. You can customize the email subject and body.
- Webhook: By default, the payload defined on the Connection is used. You can customize your payload for each notification if needed.
- Select the Alert and Recovery checkboxes for each trigger type based on when you want to send a notification. You can have different Trigger Conditions send a notification to different channels. For example, you can get notified on PagerDuty for critical Incidents and get an email or Slack notification for warning incidents.
tipSee the Notifications section for details on alert and recovery notifications.
If your connection type is Lambda, Microsoft Teams, OpsGenie, PagerDuty, Slack, or a generic webhook the Recovery checkbox enables an automatic resolution process that updates the connection when an alert has recovered within Sumo Logic. Support for other connection types is coming soon.
- Add Notifications to add additional notification channels as needed. You can configure different notifications for each trigger type, critical, warning, and missing data.
- The Connection Type specifies the notification channel where you want to get notified, such as an email or webhook. See Connections for details. Monitor notifications support variables to reference its configuration settings or your raw data. See alert variables for a table of the available variables.
Enter a Name for the Monitor and the Location you want it saved to. A Description is optional.
Playbooks allow admins to codify tribal knowledge for an on-call so they know what exactly to do when they receive an alert. You have the option to provide a playbook when creating a Monitor, as shown in the below image. Markdown is supported.
Click the Save button at the top right of the panel when you're finished configuring the Monitor.
