This topic describes the limits of the alerting feature in Log Service.

Category Item Description
Monitoring and alerting Number of alert monitoring rules You can create a maximum of 100 alert monitoring rules in each project.

If you want to increase the quota, you can submit a ticket. The quota for each project can be increased to 200.

Basic limits on query and analysis operations For more information about the limits on query and analysis operations, see Query and analysis.
Concurrency limits on query and analysis operations If a large number of query and analysis operations are performed at the same time in a project and a large number of alert monitoring rules are created, the number of concurrent search statements or analytic statements may exceed the upper limit and alert monitoring may fail. For example, if you use an SDK to query and analyze data, the number of concurrent query operations or analysis operations in the project may exceed the upper limit. We recommend that you set the Dedicated SQL parameter to Auto when you create an alert monitoring rule. This way, you can perform more concurrent query and analysis operations. For more information, see Create an alert monitoring rule for logs.

If you want to enable the Dedicated SQL feature, make sure that the related project has sufficient compute units (CUs) of Dedicated SQL. For more information, see Enable Dedicated SQL.

Result of a single query statement
  • By default, a search statement returns a maximum of 100 rows of data. The evaluation result of the trigger condition based on the number of rows of data may be inaccurate. In this case, we recommend that you use the COUNT function to calculate the number of rows of data.
  • By default, a query statement that contains an analytic statement returns a maximum of 100 rows of data. You can use a LIMIT clause to specify the number of rows of data to return.

    If the result of an analytic statement contains more than 1,000 rows of data, Log Service selects only the first 1,000 rows of data for set operations.

  • If you specify three query statements but do not set the Set Operation parameter to No Merge, only the first 100 rows of data in the result of each query statement are used for set operations.
  • If you set the Set Operation parameter to No Merge when you specify two or more query statements, and turn on No Data Alert, Log Service checks whether no data is returned based on the result of only the first query statement.
Number of query statements for set operations You can specify one to three query statements for set operations.
Length of a field value If the length of a field value exceeds 1,024 characters, the field value is truncated, and only the first 1,024 characters are used for analysis.
Time range for a query The time range in a query statement cannot exceed 24 hours.
Update effectiveness of resource data When you update resource data, the update does not immediately take effect. The update takes effect within 15 minutes.
Alert management Group Interval parameter in an alert policy The minimum value of the Group Interval parameter is 15 seconds. If you specify a group interval that is less than 15 seconds, Log Service checks data at an interval of 15 seconds.
Matching conditions in policies When you configure conditions in an alert policy or action policy, we recommend that you specify a project name, the ID of an alert monitoring rule, the name of an alert monitoring rule, a severity level, a simple label, or a simple annotation as a condition.
  • If you want to match a string, we recommend that you specify a short common string. Example: foobar.

    You cannot specify line feeds or double quotation marks (""). For example, foo "bar" cannot be parsed.

  • If you use regular expressions to match data, you cannot specify glob expressions. For example, *Error is a glob expression whereas .*Error is a regular expression.
Number of incidents A maximum of 1,000 incidents can be retained within a period of 30 days. If the number of incidents exceeds 1,000 within the period, the earliest incident is automatically overwritten by the latest incident.
Number of incident comments A maximum of 10 comments can be added to each incident. If the number of comments for an incident exceeds 10, the earliest comment is automatically overwritten by the latest comment.
Update effectiveness of alert-related configurations An update of alert-related configurations, such as alert policies, action policies, alert templates, users, user groups, and on-duty groups, take effect about 1 minute after the update.
Notification management Notification methods The following information describes the limits on each notification method. If the limit is exceeded, you may not receive alert notifications. If no alert notification is received, you can view the related errors on the Global Alert Troubleshooting Center dashboard. For more information, see Global Alert Troubleshooting Center.
  • Voice Call
    Only mobile phone numbers whose country code is 86 in the Chinese mainland are supported.
    Note
    • If a voice call is not answered, Log Service sends a text message.
    • You are charged for a voice call regardless of whether the call is answered. You are not charged for the text message that is sent upon a non-answered voice call.
  • DingTalk

    Each DingTalk chatbot can send a maximum of 20 alert notifications every minute.

  • Enterprise WeChat

    Each Enterprise WeChat robot can send a maximum of 20 alert notifications every minute.

  • Lark
    • Each Lark robot can send a maximum of 20 alert notifications every minute.
    • You can set the Notified Contacts parameter to No Reminder or All. You cannot set the parameter to Specified Members.
  • Webhook-Custom
    • The specified webhook URL must be accessible over the Internet.
    • If the status code 200 is returned, the webhook call was successful. Other status codes indicate that the call failed.
  • Function Compute

    Only the functions that start with sls-ops- are supported.

For more information, see Notification methods.

Notification content Log Service imposes a limit on the length of the content of alert notifications that are sent by each notification method. If the length of the content exceeds the corresponding limit, Log Service truncates the content to ensure that alert notifications can be sent. However, an alert notification may still fail to be sent even if the content of the alert notification is truncated. This issue may occur if the truncated content is invalid or specific content cannot be sent by a specified notification method. For example, if the truncated content of an alert notification is in an invalid Markdown or HTML format, the alert notification may still fail to be sent. The content of alert notifications that are sent by text messages or voice calls is text. If the content is truncated, the alert notifications can be sent.

To prevent the preceding issue, we recommend that you configure an alert template based on the limit on the corresponding notification method. The following information describes the length limit on each notification method. A Chinese character, letter, digit, or punctuation is counted as a character.

  • SMS Message

    A notification can contain a maximum of 256 characters.

  • Voice Call

    A notification can contain a maximum of 256 characters.

  • Email

    A notification cannot exceed 8 KB in size.

  • DingTalk

    A notification cannot exceed 8 KB in size.

  • Enterprise WeChat
    • A notification cannot exceed 4 KB in size.
    • If you set the Notified Contacts parameter to All or Specified Members, Enterprise WeChat supports only plain text in alert notifications, instead of the Markdown format.
  • Lark

    A notification cannot exceed 8 KB in size.

  • Slack

    A notification cannot exceed 8 KB in size.

  • Webhook-Custom

    A notification cannot exceed 16 KB in size.

  • Notifications

    A notification cannot exceed 8 KB in size.

  • Function Compute

    A notification cannot exceed 16 KB in size.

  • EventBridge

    A notification cannot exceed 16 KB in size.

Alert template configurations If the configurations of an alert template are invalid, the alert template may fail to be rendered and an error message is returned. If you receive an alert notification that contains Template render error or similar information, check whether the configurations of the alert template are valid based on the related alert template syntax and the returned error message. For more information, see Syntax for new alert templates.
Alert template variables The value of a variable cannot exceed 2 KB in size. If a value exceeds 2 KB in size, the value is truncated.
Notification quota A recipient can receive a maximum of 9,999 emails, text messages, or phone calls per day. For more information, see Configure notification quotas.