Alerting, Event Management, and Incident Notification Configuration
This domain tests alerting, event management, and incident notification: how Instana turns conditions into events, how alerts are scoped, and how notifications reach responders.
Alerting model
Smart Alerts evaluate entity metrics and events over a time window. An alert configuration defines scope, condition, aggregation, threshold, severity, and notification channels. Events are generated when conditions fire or resolve; issues and incidents group related events. Maintenance windows and silencing suppress noise during known change periods.
Notification design
Channels include email, chat, ticketing, paging, and webhooks. Route by severity and team; test channels after changes. Use on-call schedules and escalation policies so a critical alert reaches a human, not just a shared inbox. Keep alert names and runbook links actionable.
Worked example
Alert when production host CPU exceeds 90% for five minutes. Scope with a DFQ for entity.zone:prod, choose CPU utilization, average aggregation, a five-minute window, warning and critical thresholds, and a paging channel. Test with a low threshold in staging before enabling production.
Traps
Alerting on instantaneous spikes, duplicating the same condition across multiple channels, forgetting time zones in maintenance windows, and leaving a test channel enabled are common mark-losers. Always confirm resolved notifications work.