How to use built-in alert rules for Logtail - Simple Log Service

Simple Log Service provides built-in alert rules for Logtail. You can use the rules to monitor Logtail in real time. Then, you can receive alert notifications based on the notification methods that you specify, such as DingTalk. This topic describes how to use built-in alert rules to monitor Logtail.

Prerequisites

Important log collection is enabled for the project that you want to manage. For more information, see Enable the service log feature. For more information about important logs, see Log types.

Background information

After you enable important log collection for a project, Simple Log Service automatically creates a Logstore named internal-diagnostic_log in the project to store Logtail heartbeat logs. Simple Log Service predefines alert rules for Logtail based on the logs. You can use the rules to monitor Logtail in real time.

Step 1: Configure an action policy

By default, the built-in alert rules for Logtail are associated with the built-in action policy whose ID is sls.app.logtail.builtin. Before you create an alert rule, you must specify one or more notification methods in the action policy.

Log on to the Simple Log Service console.
In the Projects section, find the project for which you enable important log collection and click the name of the project.
In the left-side navigation pane, click Alerts.
On the Alert Center page, choose Notification Management > Action Policy.
In the list of action policies, find the action policy whose ID is sls.app.logtail.builtin and click Edit in the Actions column.
In the Edit Action Policy dialog box, change the value of the Request URL parameter to the webhook URL of your DingTalk chatbot. For more information, see DingTalk-Custom. Retain the default settings for other parameters. Click Confirm.
Note
You can also use other notification methods based on your business requirements. For more information, see Notification methods.

Step 2: Create an alert rule

On the Alert Center page, click the Alert Rules tab.
On the Alert Rules tab, click the icon to the right of Create Alert.
Click Create from Template.
In the Create from Template panel, click Logtail Fault Monitor. Then, click the template that you want to use.
In the panel that appears, configure the parameters to create an alert rule. The parameters are preconfigured. You can directly click OK. For more information, see Create an alert rule for logs.
After the alert rule is created, view the alert rule on the Alert Rules tab.