This topic describes the limits of the alerting feature in Log Service.
|Monitoring and alerting||Number of alert monitoring rules||You can create a maximum of 100 alert monitoring rules in each project.
If you want to increase the quota, you can submit a ticket. The quota for each project can be increased to 200.
|Basic limits on query and analysis operations||For more information about the limits on query and analysis operations, see Query and analysis.|
|Concurrency limits on query and analysis operations||If a large number of query and analysis operations are performed at the same time
in a project and a large number of alert monitoring rules are created, the number
of concurrent search statements or analytic statements may exceed the upper limit
and alert monitoring may fail. For example, if you use an SDK to query and analyze
data, the number of concurrent query operations or analysis operations in the project
may exceed the upper limit. We recommend that you set the Dedicated SQL parameter to Auto when you create an alert monitoring rule. This way, you can perform more concurrent
query and analysis operations. For more information, see Create an alert monitoring rule for logs.
If you want to enable the Dedicated SQL feature, make sure that the related project has sufficient compute units (CUs) of Dedicated SQL. For more information, see Enable Dedicated SQL.
|Result of a single query statement||
|Number of query statements for set operations||You can specify one to three query statements for set operations.|
|Length of a field value||If the length of a field value exceeds 1,024 characters, the field value is truncated, and only the first 1,024 characters are used for analysis.|
|Time range for a query||The time range in a query statement cannot exceed 24 hours.|
|Update effectiveness of resource data||When you update resource data, the update does not immediately take effect. The update takes effect within 15 minutes.|
|Alert management||Group Interval parameter in an alert policy||The minimum value of the Group Interval parameter is 15 seconds. If you specify a group interval that is less than 15 seconds, Log Service checks data at an interval of 15 seconds.|
|Matching conditions in policies||When you configure conditions in an alert policy or action policy, we recommend that
you specify a project name, the ID of an alert monitoring rule, the name of an alert
monitoring rule, a severity level, a simple label, or a simple annotation as a condition.
|Number of incidents||A maximum of 1,000 incidents can be retained within a period of 30 days. If the number of incidents exceeds 1,000 within the period, the earliest incident is automatically overwritten by the latest incident.|
|Number of incident comments||A maximum of 10 comments can be added to each incident. If the number of comments for an incident exceeds 10, the earliest comment is automatically overwritten by the latest comment.|
|Update effectiveness of alert-related configurations||An update of alert-related configurations, such as alert policies, action policies, alert templates, users, user groups, and on-duty groups, take effect about 1 minute after the update.|
|Notification management||Notification methods||The following information describes the limits on each notification method. If the
limit is exceeded, you may not receive alert notifications. If no alert notification
is received, you can view the related errors on the Global Alert Troubleshooting Center
dashboard. For more information, see Global Alert Troubleshooting Center.
For more information, see Notification methods.
|Notification content||Log Service imposes a limit on the length of the content of alert notifications that
are sent by each notification method. If the length of the content exceeds the corresponding
limit, Log Service truncates the content to ensure that alert notifications can be
sent. However, an alert notification may still fail to be sent even if the content
of the alert notification is truncated. This issue may occur if the truncated content
is invalid or specific content cannot be sent by a specified notification method.
For example, if the truncated content of an alert notification is in an invalid Markdown
or HTML format, the alert notification may still fail to be sent. The content of alert
notifications that are sent by text messages or voice calls is text. If the content
is truncated, the alert notifications can be sent.
To prevent the preceding issue, we recommend that you configure an alert template based on the limit on the corresponding notification method. The following information describes the length limit on each notification method. A Chinese character, letter, digit, or punctuation is counted as a character.
|Alert template configurations||If the configurations of an alert template are invalid, the alert template may fail
to be rendered and an error message is returned. If you receive an alert notification
|Alert template variables||The value of a variable cannot exceed 2 KB in size. If a value exceeds 2 KB in size, the value is truncated.|
|Notification quota||A recipient can receive a maximum of 9,999 emails, text messages, or phone calls per day. For more information, see Configure notification quotas.|