All Products
Search
Document Center

Simple Log Service:Limits

Last Updated:Feb 23, 2024

This topic describes the limits of the alerting feature in Simple Log Service.

Category

Item

Description

Monitoring and alerting

Number of alert monitoring rules

You can create up to 100 alert monitoring rules in each project.

If you want to increase the quota, you can submit a ticket. The quota can be increased to 200 in each project.

Basic limits on query statements

For more information about the limits on query statements, see Query and analysis.

Concurrency limits on query statements

If a large number of query statements are executed in a project at the same time and a large number of alert monitoring rules are created, the number of concurrent query statements may exceed the upper limit and monitoring may fail. For example, if you use an SDK to execute an excessive number of query statements in a project, the number of concurrent query statements may exceed the upper limit and monitoring may fail. We recommend that you set the Dedicated SQL parameter to Auto when you create an alert monitoring rule. This way, you can execute a larger number of query statements at the same time. For more information, see Create an alert monitoring rule for logs.

If you want to enable the Dedicated SQL feature, make sure that your project has sufficient compute units (CUs) of Dedicated SQL. For more information, see Enable Dedicated SQL.

Results of a single query statement

  • By default, a search statement returns up to 100 rows of data. The evaluation result of trigger conditions that are based on the number of data rows may be inaccurate. In this case, we recommend that you use the COUNT function to calculate the number of data rows.

  • By default, a query statement that contains an analytic statement returns up to 100 rows of data. You can use a LIMIT clause to specify the number of rows of data to return.

    If the result of a query statement that contains an analytic statement contains more than 1,000 rows of data, Simple Log Service selects only the first 1,000 rows of data for set operations.

  • If you specify three query statements but do not set the Set Operation parameter to No Merge, only the first 100 rows of data in the result of each query statement are used for set operations.

  • If you set the Set Operation parameter to No Merge when you specify two or more query statements and turn on No Data Alert, Simple Log Service checks whether no data is returned based on the result of only the first query statement.

Number of query statements for set operations

You can specify one to three query statements for set operations.

Field value length

If the length of a field value exceeds 1,024 characters, the field value is truncated, and only the first 1,024 characters are used for analysis.

Time range for a query statement

The time range for a query statement cannot exceed 24 hours.

Update effectiveness of resource data

When you update resource data, the update does not immediately take effect. The update takes effect within 15 minutes.

Alert management

Group Interval parameter in an alert policy

The minimum value of the Group Interval parameter is 15 seconds. If you specify a value that is less than 15 seconds, Simple Log Service checks data at 15-second intervals.

Matching conditions in policies

When you configure conditions in an alert policy or action policy, we recommend that you specify a project name, the ID of an alert monitoring rule, the name of an alert, a severity level, a label, or a notation as a condition.

  • If you want to use strings to match data, we recommend that you specify a simple string as a condition. Example: foobar.

    A condition cannot contain line feeds or double quotation marks (""). For example, foo "bar" cannot be parsed.

  • If you use regular expressions to match data, you are not allowed to specify glob expressions. For example, *Error is a glob expression whereas .*Error is a supported regular expression.

Number of incidents

Up to 1,000 incidents can be retained in 30 days. If the number of incidents exceeds 1,000, the earliest incident is automatically overwritten by the latest incident.

Number of incident comments

Up to 10 comments can be added for each incident. If the number of comments for an incident exceeds 10, the earliest comment is automatically overwritten by the latest comment.

Update effectiveness of alert-related configurations

An update of alert-related configurations such as alert policies, action policies, alert templates, users, user groups, and on-duty groups takes effect approximately 1 minute after the update.

Notification management

Notification methods

The following list describes the limits on each notification method. If a specified limit is exceeded, you may fail to receive alert notifications. If no alert notification is received, you can view the related errors on the Global Alert Troubleshooting Center dashboard. For more information, see Global Alert Troubleshooting Center.

  • Voice call

    This notification method supports only mobile phone numbers in the Chinese mainland, which are prefixed with 86.

    Note
    • If a voice call is not answered, Simple Log Service sends a text message.

    • You are charged for a voice call regardless of whether the call is answered. You are not charged for the text message that is sent upon a non-answered voice call.

  • DingTalk

    Each DingTalk chatbot can send up to 20 alert notifications every minute.

  • Enterprise WeChat

    Each Enterprise WeChat robot can send up to 20 alert notifications every minute.

  • Lark

    • Each Lark robot can send up to 20 alert notifications every minute.

    • You can set Notified Contacts to No Reminder or All. You cannot set the parameter to Specified Members.

  • Webhook-Custom

    • The webhook URL must be accessible over the Internet.

    • If a webhook is successfully invoked, the HTTP status code 200 is returned. If the HTTP status code 200 is not returned, Simple Log Service considers the request as failed.

  • Function Compute

    Only the functions that start with sls-ops- are supported.

For more information, see Notification methods.

Notification content

Simple Log Service imposes a limit on the length of the content of alert notifications that are sent by using each notification method. If the length of the content exceeds the specified limit, Simple Log Service truncates the content to ensure that alert notifications can be sent. An alert notification may still fail to be sent even after the content of the alert notification is truncated. This issue may occur if the content obtained after the truncate operation is invalid or specific content cannot be sent by using a notification method. For example, if the content obtained after the truncate operation of an alert notification is in an invalid Markdown or HTML format, the alert notification may fail to be sent. The content of alert notifications that are sent by text message or voice call is in the plain text format. If the content is truncated, the alert notifications can still be sent.

To prevent the sending failures, we recommend that you configure an alert template based on the content length limit of the specified notification method. The following list describes the content length limit of each notification method. A letter, digit, or punctuation mark is considered a character.

Note

If the length of a field value exceeds 1,024 characters, the field value is truncated, and only the first 1,024 characters are retained.

  • SMS Message

    A notification can contain up to 256 characters.

  • Voice call

    A notification can contain up to 256 characters.

  • Email

    A notification cannot exceed 8 KB in size.

  • DingTalk

    A notification cannot exceed 8 KB in size.

  • Enterprise WeChat

    • A notification cannot exceed 4 KB in size.

    • If you set Notified Contacts to All or Specified Members, Enterprise WeChat supports only plain text in alert notifications, instead of the Markdown syntax.

  • Lark

    A notification cannot exceed 8 KB in size.

  • Slack

    A notification cannot exceed 8 KB in size.

  • Webhook-Custom

    A notification cannot exceed 16 KB in size.

  • Notifications

    A notification cannot exceed 8 KB in size.

  • Function Compute

    A notification cannot exceed 16 KB in size.

  • EventBridge

    A notification cannot exceed 16 KB in size.

Alert template configurations

If the configurations of an alert template are invalid, the alert template may fail to be rendered and an error message is returned. If you receive an alert notification that contains Template render error or similar information, check whether the configurations of the alert template are valid based on the alert template syntax and the error message that is returned. For more information, see Syntax for new alert templates.

Alert template variables

The value of a variable cannot exceed 2 KB in size. If a value exceeds 2 KB in size, the value is truncated.

Notification quota

A recipient can receive up to 9,999 emails, text messages, or phone calls per day. For more information, see Configure notification quotas.