Overview This session brought together a highly engaged global community of practitioners across network engineering, IT operations, and platform teams to dive deep into alerting strategies in LogicMonitor. From dynamic thresholds to escalation chains and upcoming automation capabilities, the conversation blended practical use cases, real-world challenges, and forward-looking product insights . Attendees didn’t just listen. They actively shaped the discussion with thoughtful questions and candid feedback, making this session especially valuable for teams looking to reduce alert noise, improve signal quality, and operationalize smarter monitoring . Key Highlights Dynamic thresholds leverage up to 15 days of historical data to identify patterns and reduce false positives Static thresholds will take priority if both static and dynamic thresholds are configured simultaneously There is no maximum limit to escalation chain stages , but timing is controlled at the alert rule level Automated Remediation is launching soon, enabling automatic and manual actions like service restarts directly from alerts Users shared real-world strategies like Scheduled Down Time (SDT) to handle predictable spikes such as nightly batch jobs Strong community feedback surfaced around UI improvements, alert tuning, and expanded data visibility capabilities Q&A Q: Regards to Dynamic Threshold to recognise a pattern what is the time window for this? A: Dynamic thresholds use up to 15 days of historical data Q: In configuring a datapoint and for Alert Trigger Interval (consecutive scans) what is the difference between the settings 1 and Immediate? A: These settings can appear similar in behavior, but Immediate triggers without waiting for consecutive scans while 1 requires one full polling cycle. Q: What if a CPU spike goes from 5% to 95% instantly but it is expected when a certain job kicks off? A: Dynamic thresholds should catch predictable spikes if they are consistent, but reviewing configurations or sharing examples with support is recommended. Q: How many stages can we have and can we provide the time interval for Stage 3? A: There is no maximum to escalation chain stages. The time interval is set at the alert rule level and applies to each stage. Q: Can we auto restart the Windows service when it is stopped directly from LogicMonitor? A: Automated Remediation is being released in 1H and will support this use case, including manual trigger options. Q: Does the duration in an alert include the polling schedule or is it just the time from alert to clear? A: Duration reflects the time from when the alert is triggered to when it clears. Q: Is there a mechanism to delay alerts before sending to an integration to account for short reboots? A: This can be managed through alert rule configurations such as escalation intervals and thresholds. Q: Are there plans to support character or string values in Raw Data? A: This is not currently supported, but best practices include leveraging custom modules or external context handling for richer data visibility. Customer Call-outs 🌟 “Did not know about the top daily weekly alert reports. Thank you for showing this to us today!” 🌟 “I just had to change the name of a Windows server collector and LogicMonitor handled it faster than our DNS server.” What's Next We're almost at the bottom of the slope, wrapping up with the newest Edwin AI badge session. Expect more hands-on demos and plenty of time for live Q&A with LogicMonitor experts. Register for Ski School Register for Edwin AI Ski Session Additional Resources Alerts badge Best Practices for Practitioner: LM Log Analysis and Anomaly Detection Want to review the session? Watch the recording directly from the event page!
