How to set up alerts for K8s Event Center in Simple Log Service - Simple Log Service

Simple Log Service provides built-in alert rule templates that you can use to monitor your Kubernetes cluster in real time and receive alert notifications through channels such as DingTalk.

Prerequisites

An event center is created in K8s Event Center, and Kubernetes cluster events are collected to the event center. For more information, see Create and use the K8s Event Center.

Background information

K8s Event Center includes built-in alert rule templates, an SLS ACK built-in action policy, an SLS ACK built-in user group, and SLS ACK built-in content templates (Pod, Node, Object, and general ACK). These resources cover most alerting scenarios and are related as follows:

An alert rule template specifies the SLS ACK built-in action policy.
You can specify the ACK user group and an alert template in the ACK action policy. The alert template can be an ACK-pod alert template, ACK alert template, ACK-node alert template, or ACK-object alert template.

After an alert is triggered, Simple Log Service sends an alert notification to the specified users based on the action policy.

Step 1: Create a user

Log on to the Simple Log Service console.
In the Log Application section, on the Intelligent O&M tab, click K8s Event Center.
In the left-side navigation pane, click the icon next to the target event center, and then click Alert Configuration.
On the Alert Center page, choose Notification Objects > Users.
Create a user.

For more information, see Create users.

Step 2: Add the user to the ACK user group

On the Alert Center page, choose Notification Objects > User Groups.
In the user group list, find sls.app.ack.builtin and click Modify.
In the Edit User Group dialog box, move the user that you created from the Available Members list to the Selected Members list, and then click Confirm.

Step 3: Create an alert rule

Simple Log Service provides dozens of built-in alert rule templates for K8s Event Center. Select a template that fits your requirements to add an alert rule. This section uses the Node changes to the ready state alert rule template as an example.

On the Alert Center page, to the right of Alert Rules > Create Alert, click the icon.
Click Create from Template.
In the Create from Template panel, click SLS K8s Event Center.
From the list of alert rule templates, click the desired template.
In the Create Alert panel, set cluster_id to your cluster ID. For details on other parameters, see Create an alert rule.

What to do next

After you create an alert rule for an event center, you can perform the following operations.

Operation	Description
Disable an alert rule	Disabling an alert rule stops it from triggering alerts and changes its Status to Disabled. The alert rule configurations are preserved. You can re-enable the rule without reconfiguring it.
Pause an alert rule	Pausing an alert rule temporarily suppresses alerts for a specified period.
Delete an alert rule	The alert rule configurations are permanently removed. To use the rule again, you must reconfigure it.
Reconfigure an alert rule	Modify the parameters of an existing alert rule.
View	View the details of an alert rule and its alert history.
Follow	Add an alert rule to your followed list for quick access.
Create a custom alert rule	If the built-in alert rule templates do not meet your needs, you can click Create Alert Monitoring Rule to create a custom alert rule. For more information, see Create a log alert rule.