An incident is a record of the triggering of an alerting policy. Cloud Monitoring opens an incident when a condition of an alerting policy has been met. The incident contains information you can use to investigate the cause of the alert.When a matching log entry first triggers your log-based alerting policy, Monitoring opens an incident and sends you a notification.
This document describes how you can view, investigate, and manage incidents for log-based alerting policies.
To see a list of incidents, do the following:
In the Cloud Console toolbar, click menu Navigation menu, and then select Monitoring:
In the Monitoring navigation pane, select notifications Alerting:
- The Summary pane lists the number of open incidents.
- The Incidents pane displays the most recent incidents. To hide closed incidents in the table, click Hide closed incidents.
Finding older incidents
The Incidents pane on the Alerting page shows the most recent open incidents. To locate older incidents, do one of the following:
To page through the entries in the Incidents table, click arrow_back_ios Newer or arrow_forward_ios Older.
To navigate to the Incidents page, click See all incidents. From the Incidents page, you can do all the following:
- Hide closed incidents: To list only open incidents in the table, click Hide closed incidents.
- Filter incidents: For information about adding filters, see Filtering incidents.
- Acknowledge or close an incident: To access these options, click more_vert More options in the incident's row, and make a selection from the menu. For more information, see Managing incidents.
When you enter a value on the filter bar, only incidents that match the filter are listed in the Incidents table. If you add multiple filters, then an incident is displayed only if it satisfies all the filters.
To add a filter the table of incidents, do the following:
On the Incidents page, click filter_list Filter table and then select a filter property. Filter properties include all the following:
- State of the incident
- Name of the alerting policy
- When the incident was opened or closed
Select a value from the secondary menu or enter a value in the filter bar.
To view the details of an incident, you must have, at a minimum,
the Identity and Access Management role of
roles/monitoring.viewer. For more information, see
Unable to view incident details due to a permission error.
After you have found the incident you want to investigate, go to the Incident details page for that incident. To view the details, click on the incident summary in the table of incidents on either the Alerting page or the Incidents page.
Alternately, if you received a notification that includes a link to the incident, then you can use that link to view the incident details.
The following screenshot shows the details page for an incident:
The Incident details page provides the following information:
Status information, including:
- Name: The name of the alerting policy that caused this incident.
- Status: The status of the incident: open, acknowledged, or closed.
- Duration: The length of time for which the incident was open.
A Logs pane, which displays log entries that match the alert query. The pane lets you filter these entries as part of your investigation.
To refresh the log-entries list, click refresh Refresh. To view the logs in the Logs Explorer, click open_in_new View in Logs Explorer.
Information about the alerting policy that caused the incident:
Condition pane: identifies the condition in the alerting policy that caused the incident. For log-based alerting policies creating by using the Logs Explorer, the condition name is always "Log match condition."
This pane also reports the time between notifications, and auto-close duration from the alerting policy.
Message pane: provides a brief explanation of the cause based on the configuration of the condition in the alerting policy. This pane is always populated.
Documentation pane: shows the documentation template for notifications that you provided when creating the alerting policy. This information might include a description of what the alerting policy monitors and include tips for mitigation.
If you skipped this field when creating the alerting policy, then this pane reports "No documentation is configured."
- Labels: reports the following:
- The labels and values for the monitored resource included in the log entry that triggered the alerting policy. This information can help you identify the specific monitored resource that caused the incident. These labels are also reported in the Message string.
- Any user-specified labels and values that you defined on the alerting policy. You can use these labels for organizing and identifying alerting policies.
The Incidents details page also provides tools for investigating the incident:
- Links to other troubleshooting tools. The configuration of your project
and alerting policy and the age of the incident determine
which links are available.
- To see the details page for the alerting policy, click View policy.
- To edit the definition of the alerting policy, click Edit policy.
- To see related log entries in Logs Explorer, click View logs. For more information, see Using Logs Explorer.
- Annotations: Provides a log of your findings, results, suggestions,
or other comments from your investigation of the incident.
- To add an annotation, enter text in the field and click Add comment.
- To discard the comment, click Cancel.
You can also acknowledge or close incidents from the Incident details page. For more information, see Managing incidents.
Incidents are in one of the following states:
error Open: The log-based alerting policy was triggered, and the incident is still open. If the same alert is triggered again and there is already an incident open, then a new incident isn't opened.
warning Acknowledged: The incident is open and has manually been marked as acknowledged. Typically, this status indicates that the incident is being investigated.
check_circle Closed: You have manually closed the incident, or it was automatically closed after the auto-close period expired.
To manage incidents, your role must include the
monitoring.alertPolicy.update permission. These permissions are included
in the Monitoring Editor role,
roles/monitoring.editor. For detailed
information about roles and permissions, see
Access control: Predefined roles.
We recommend that you mark an incident as acknowledged when you begin investigating the cause of the incident.
To mark an incident as acknowledged, do the following:
- In the Incidents pane of the Alerting dashboard, click See all incidents.
On the Incidents page, find the incident that you want to acknowledge, and then do one of the following:
- Click more_vert More options and then select Acknowledge.
- Open the details page for the incident and then click Acknowledge incident.
You can let Monitoring close an incident for you, or you can close the incident.
Monitoring automatically closes an incident when the auto-close duration for the alerting policy expires. By default, the auto-close duration is 7 days. The minimum auto-close duration is 30 minutes.
To close an incident, do the following:
- In the Incidents pane of the Alerting dashboard, click See all incidents.
On the Incidents page, find the incident that you want to close, and then do one of the following:
- Click more_vert More options and then select Close this incident.
- Open the details page for the incident and then click Close incident.
Unable to close incident, try again in a few minutes. You can't close a new incident immediately because the triggering log entry is still considered active by the alerting system.
- To create and manage alerting policies with the Cloud Monitoring API or from the command line, see Managing alerting policies by API.