Deutsch
Alerts & thresholds

Alert threshold

An alert threshold is a limit set for a measured value. When the value rises above or falls below it, the monitoring tool sends an alert. This entry covers thresholds in SEO and website monitoring, such as the share of pages returning errors.

How do thresholds work?

Datadog describes a threshold alert as one of the simplest kinds of alerts. It triggers whenever the metric goes above or below a user-defined value. Two refinements are common.

  • A time condition. The metric must stay beyond the limit for a period, for example several checks in a row, so that a single spike does not trigger a message.
  • Several levels. Datadog gives the example of a warning threshold that posts to a team channel and a critical threshold that pages an on-call person.

A static threshold uses a fixed number. A dynamic threshold is calculated from the metric’s history. Microsoft’s Azure Monitor, for example, learns hourly and daily patterns from past data, and its documentation says that it uses 10 days of history for the calculation and needs three weeks to detect weekly patterns. Datadog recommends anomaly detection or change alerts for metrics whose baseline shifts over time.

Monitoring loop: measure, compare, alertA loop in six steps. 1 Fetch: request pages or data again. 2 Compare with the previous state, for example a changed title or status code 404 instead of 200. 3 Check a rule or threshold. Without a relevant deviation there is no alert, and the next fetch follows. With a deviation, 4 an alert goes to the responsible person, 5 review whether the change is real and intended, 6 fix. Then the next fetch begins. Schematic view based on practice.no relevant deviation → no alertdeviationnext fetch1 · Fetchrequest pages ordata again2 · Comparewith the previous state,e.g. status 200 → 4043 · Ruledoes a thresholdor rule match?4 · Alertnotify theresponsible person5 · Reviewreal change or falsealarm? Intended?6 · Fixfix the cause,verify the resultSchematic view based on practice. Each team sets its own interval and rules.
Monitoring loop based on practice: fetch again, compare with the previous state, check a rule or threshold. An alert follows only for a relevant deviation, then review and fix. This is not a standard; each team sets its own interval and rules. Schematic illustration.

Example

In this constructed example, a crawl of an online shop finds 2 percent of URLs returning a 404 status. The team sets a warning at 3 percent and a critical alert at 8 percent. A faulty deployment pushes the share to 11 percent, and the critical alert fires. A static limit works here because the normal level is stable. For organic clicks, which vary by weekday, a fixed limit would fire on every weekend dip.

Normal range, outlier, false alarm (example data, made up)Line chart with made-up example data over 56 days, shown as an index (100 = a typical weekday). An expected band shows the normal range for each weekday; at weekends it is lower. The line mostly moves within the band, which is normal noise. On day 24, a public holiday, the value drops below the band. This triggers an alert even though the cause is known, so it is a false alarm. From day 44 the value drops sharply and stays below the band. That is a real drop and a justified alert. The lower edge of the band serves as the threshold.Example data, made upExpected bandMeasured valueAlertFalse alarmIndex(100 = typical weekday)6080100120Day 1Day 14Day 28Day 42Day 56lower edge= thresholdnormal noise within the bandDay 24, public holiday: below theband, cause known → false alarmfrom day 44: sharply andpersistently below the band→ alertMade-up values for illustration. Band = expected value per weekday ± tolerance.Example data, made up.
Made-up example data. A metric mostly moves within its expected range. A public holiday falls outside the band and triggers a false alarm, while a sustained drop triggers a justified alert. Example based on practice, not a standard method. Schematic illustration.

Common mistakes

  • Taking a threshold from a template without checking the normal range of the site.
  • A limit that is so low that it creates false alarms, or so high that real problems stay unseen.
  • No time condition for metrics that fluctuate briefly.

Sources

  1. Alerting 101: Metric checks – Datadogdatadoghq.com
  2. Dynamic thresholds in Azure Monitor alerts – Microsoft Learnlearn.microsoft.com
  3. Metric Threshold Alerts – Lytics docsdocs.lytics.com

Last updated: