Ski Session: Alerts Recap
Overview
This session brought together a highly engaged global community of practitioners across network engineering, IT operations, and platform teams to dive deep into alerting strategies in LogicMonitor. From dynamic thresholds to escalation chains and upcoming automation capabilities, the conversation blended practical use cases, real-world challenges, and forward-looking product insights.
Attendees didn’t just listen. They actively shaped the discussion with thoughtful questions and candid feedback, making this session especially valuable for teams looking to reduce alert noise, improve signal quality, and operationalize smarter monitoring.
Key Highlights
Dynamic thresholds leverage up to 15 days of historical data to identify patterns and reduce false positives
Static thresholds will take priority if both static and dynamic thresholds are configured simultaneously
There is no maximum limit to escalation chain stages, but timing is controlled at the alert rule level
Automated Remediation is launching soon, enabling automatic and manual actions like service restarts directly from alerts
Users shared real-world strategies like Scheduled Down Time (SDT) to handle predictable spikes such as nightly batch jobs
Strong community feedback surfaced around UI improvements, alert tuning, and expanded data visibility capabilities
Q&A
Q: Regards to Dynamic Threshold to recognise a pattern what is the time window for this?
A: Dynamic thresholds use up to 15 days of historical data
Q: In configuring a datapoint and for Alert Trigger Interval (consecutive scans) what is the difference between the settings 1 and Immediate?
A: These settings can appear similar in behavior, but Immediate triggers without waiting for consecutive scans while 1 requires one full polling cycle.
Q: What if a CPU spike goes from 5% to 95% instantly but it is expected when a certain job kicks off?
A: Dynamic thresholds should catch predictable spikes if they are consistent, but reviewing configurations or sharing examples with support is recommended.
Q: How many stages can we have and can we provide the time interval for Stage 3?
A: There is no maximum to escalation chain stages. The time interval is set at the alert rule level and applies to each stage.
Q: Can we auto restart the Windows service when it is stopped directly from LogicMonitor?
A: Automated Remediation is being released in 1H and will support this use case, including manual trigger options.
Q: Does the duration in an alert include the polling schedule or is it just the time from alert to clear?
A: Duration reflects the time from when the alert is triggered to when it clears.
Q: Is there a mechanism to delay alerts before sending to an integration to account for short reboots?
A: This can be managed through alert rule configurations such as escalation intervals and thresholds.
Q: Are there plans to support character or string values in Raw Data?
A: This is not currently supported, but best practices include leveraging custom modules or external context handling for richer data visibility.
Customer Call-outs
🌟 “Did not know about the top daily weekly alert reports. Thank you for showing this to us today!”
🌟 “I just had to change the name of a Windows server collector and LogicMonitor handled it faster than our DNS server.”
What's Next
We're almost at the bottom of the slope, wrapping up with the newest Edwin AI badge session. Expect more hands-on demos and plenty of time for live Q&A with LogicMonitor experts.
Register for Edwin AI Ski Session
Additional Resources
Best Practices for Practitioner: LM Log Analysis and Anomaly Detection
Want to review the session? Watch the recording directly from the event page!
