ActionTrail provides multiple built-in alert rules that are used to detect abnormal events in the cloud. You can enable, disable, pause, resume, or delete alert rules based on your business requirements.

Background information

On the Alert Rules/Incidents tab of the Event Alerting page in the ActionTrail console, you can query alert rules. You can also move the pointer over the more icon next to the name of an alert rule to view the details of the alert rule.

ActionTrail does not support custom alert rules. If you want to add other alert rules, submit a ticket.

Enable an alert rule

  1. Log on to the ActionTrail console.
  2. In the left-side navigation pane, click Event Alerting.
  3. On the Alert Rules/Incidents tab of the Event Alerting page, find the alert rule that you want to enable and click Enable in the Actions column.
    After the alert rule is enabled, the value in the Status column is changed to Enabled.

Disable an alert rule

After you disable an alert rule, ActionTrail does not send alert notifications to the specified users or user groups when an event meets the condition of the alert rule. For example, if you disable the VPC Network Route Change Alert rule, no alert is triggered when the configuration of a virtual private cloud (VPC) route changes.

After you disable an alert rule, the alert instances generated before the alert rule is disabled are not affected, only that alert notifications are not sent.

  1. On the Alert Rules/Incidents tab of the Event Alerting page, find the alert rule that you want to disable and click Disable in the Actions column.
  2. In the Tip message, click OK.
    After the alert rule is disabled, the value in the Status column is changed to Created | Not Enabled.

Pause and resume an alert rule

When you pause an alert rule, you can specify a pause period. During the pause period, ActionTrail does not send alert notifications to the specified users or user groups when an event meets the condition of the alert rule. For example, you pause the VPC Network Route Change Alert rule, and set the pause period to 5 minutes. If the configuration of a VPC route changes within 5 minutes, no alert is triggered. If the configuration of a VPC route changes 5 minutes later, an alert is triggered.

You can resume an alert rule during the pause period. In this case, ActionTrail continues to inspect events based on the alert rule.

  1. On the Alert Rules/Incidents tab of the Event Alerting page, find the alert rule that you want to pause and click Pause in the Actions column.
  2. In the Pause Settings dialog box, set the Pause for parameter.
    You can select a pause period preset in the console or customize the pause period.
  3. Click OK.
    After the alert rule is paused, the value in the Status column indicates the time when the alert rule will be resumed, for example, Paused until 2021-05-20 18:34:03.
    Note To resume an alert rule during the pause period, click Resume in the Actions column. In the Tip message, click OK.

Delete an alert rule

If you want to delete all alert instances generated for an alert rule, you can delete the alert rule. Then, ActionTrail does not inspect events based on the alert rule.

  1. On the Alert Rules/Incidents tab of the Event Alerting page, find the alert rule that you want to delete and click Delete in the Actions column.
  2. In the Tip message, click OK.
    After the alert rule is deleted, the value in the Status column is changed to Not Created.