doc/operations/incident_management/alerts.md
{{< details >}}
{{< /details >}}
Alerts are a critical entity in your incident management workflow. They represent a notable event that might indicate a service outage or disruption. GitLab provides a list view for triage and detail view for deeper investigation of what happened.
Users with the Developer, Maintainer, or Owner role can access the Alert list at Monitor > Alerts in your project's sidebar. The Alert list displays alerts sorted by start time, but you can change the sort order by selecting the headers in the Alert list.
The alert list displays the following information:
X time ago, but is supported by a granular date/time
tooltip depending on the user's locale.Each level of alert contains a uniquely shaped and color-coded icon to help you identify the severity of a particular alert. These severity icons help you immediately identify which alerts you should prioritize investigating:
Alerts contain one of the following icons:
<!-- vale gitlab_base.SubstitutionWarning = NO -->| Severity | Icon | Color (hexadecimal) |
|---|---|---|
| Critical | {{< icon name="severity-critical" >}} | #8b2615 |
| High | {{< icon name="severity-high" >}} | #c0341d |
| Medium | {{< icon name="severity-medium" >}} | #fca429 |
| Low | {{< icon name="severity-low" >}} | #fdbc60 |
| Info | {{< icon name="severity-info" >}} | #418cd8 |
| Unknown | {{< icon name="severity-unknown" >}} | #bababa |
Go to the Alert details view by visiting the Alert list and selecting an alert from the list. You need the Developer, Maintainer, or Owner role to access alerts. Select any alert in the list to examine its alert details page.
Alerts provide Overview and Alert details tabs to give you the right amount of information you need.
The Alert details tab has two sections. The top section provides a short list of critical details such as the severity, start time, number of events, and originating monitoring tool. The second section displays the full alert payload.
In many cases, alerts are associated to metrics. You can upload screenshots of metric charts in the Metrics tab.
To do so, either:
When you upload an image, you can add text to the image and link it to the original graph.
If you add a link, it is shown above the uploaded image.
The Activity feed tab is a log of activity on the alert. When you take action on an alert, this is logged as a system note. This gives you a linear timeline of the alert's investigation and assignment history.
The following actions result in a system note:
There are different actions available in GitLab to help triage and respond to alerts.
You can change the status of an alert.
The available statuses are:
Prerequisites:
To change an alert's status:
To stop email notifications for alert recurrences in projects with email notifications enabled, change the alert's status away from Triggered.
Prerequisites:
When you close an incident that is linked to an alert, GitLab changes the alert's status to Resolved. You are then credited with the alert's status change.
{{< details >}}
{{< /details >}}
On-call responders can respond to alert pages by changing the alert status.
Changing the status has the following effects:
In GitLab 15.1 and earlier, updating the status of an alert with an associated incident also updates the incident status. In GitLab 15.2 and later, the incident status is independent and does not update when the alert status changes.
In large teams, where there is shared ownership of an alert, it can be difficult to track who is investigating and working on it. Assigning alerts eases collaboration and delegation by indicating which user is owning the alert. GitLab supports only a single assignee per alert.
To assign an alert:
Display the list of current alerts:
Select your desired alert to display its details.
If the right sidebar is not expanded, select Expand sidebar ({{< icon name="chevron-double-lg-right" >}}) to expand it.
In the right sidebar, locate the Assignee, and then select Edit. From the list, select each user you want to assign to the alert. GitLab creates a to-do item for each user.
After completing their portion of investigating or fixing the alert, users can unassign themselves from the alert. To remove an assignee, select Edit next to the Assignee dropdown list and clear the user from the list of assignees, or select Unassigned.
You can manually create a to-do item for yourself from an alert, and view it later on your To-Do List.
To add a to-do item, in the right sidebar, select Add a to-do item.
{{< details >}}
{{< /details >}}
Turn on creating incidents automatically whenever an alert is triggered.
Prerequisites:
To configure the actions: