Docs

Torch Log Service

Alarm FAQ

Alert Policy FAQ

How to avoid false alarms and false alarms?

There is a low latency between log writing and query, and there is a low time difference between index construction. If you do not consider the above time difference when configuring the query time range and execution cycle in the alarm policy, the query results of the alarm monitoring task may be inaccurate, resulting in missed alarms and false alarms.

You can avoid missing alarms and false alarms by expanding the time frame for inquiries. For detailed instructions,see Timeliness of alarm monitoring task.

Why are multiple trigger conditions configured, but only one takes effect?

The relationship between the triggering conditions of the log service alarm is OR, and the retrieval and analysis results are matched one by one in the order of the triggering conditions. After the retrieval and analysis results meet the first triggering condition, the subsequent triggering conditions are no longer matched. That is, when you add multiple trigger conditions, you need to configure them in the order from high level to low level. For specific steps, see Create alarm policy.

Why is the alarm trigger time so different from the notification time?

When using the Logging Service's default content notification template, the trigger time is {{StartTime}} , which represents the first time the alarm was triggered. After the alarm is triggered, when the next cycle has not been restored, the trigger time in the second alarm notification is still the time when the alarm was triggered for the first time in the previous cycle. If the alarm has not been restored, the alarm trigger time will not be updated, resulting in a large difference between the alarm trigger time and the notification time.

Why is the COUNT (*) result 0, but the "with data" alarm condition I configured is still triggered?

phenomenon

When creating an alert policy, use the COUNT (*) function to count the number of relevant logs and set the trigger condition to have data . When the COUNT (*) result is 0, the alarm is still triggered.

reason

When using the COUNT (*) function, a line of data is always returned in the return result, which records the calculation result of the COUNT (*) function. And setting the trigger condition to have data means that the result will be triggered if there is a data row in the returned result. So even if the COUNT (*) result is 0, that is, there are no eligible logs, the alarm will still be triggered.

Solution

Set the trigger condition using the result column of the search analysis. For example, the trigger condition is set to have data match 1 dollar.num > = 1 , indicating that there is at least one log that meets the conditions to trigger the alarm.

Why is there data in the retrieval analysis results, but the variable value in the alarm test notification is empty?

Alarm tests are only used to check the configuration of alarm policies, retrieval analysis syntax, trigger expression syntax, etc., and are not actually performed alarm monitoring tasks. When your alarm strategy is more complex, the alarm test cannot detect the problem and needs to be manually checked according to the alarm document.

Why does the trigger conditional expression prompt field not exist?

phenomenon

The triggering conditional expression prompts that the target field may not exist.

Solution

When referencing a field as a variable in a triggering conditional expression, ensure that the target field is present in the collection of retrieved analysis results. If an error still occurs in the storage destination field, ignore the error.

Alarm test error code

When creating an alarm policy, you can use alarm testing to preview notifications and verify your policy configuration. This topic lists alarm test error codes, reasons for errors, and solutions.

Error Code	Error message	Reason for error	Solution
AlarmProjectNotExist	No project (%s) exists.	The project used for alarm monitoring was deleted.	Create a new project and log topic, upload logs, and then recreate the alarm policy in the new project
AlarmParseSQLErr	Failed to parse alarm execution statement %d: %s	The syntax of the execution statement you entered is incorrect.	In the execution statement dialog box, debug the query and analysis statement until you preview the results that meet your requirements. For details about query and analysis statements, refer to Query overviewand Analysis Overview.
AlarmParseTriggerConditionErr	Failed to parse alarm trigger condition %d: %s	There is a syntax error in the trigger condition expression you entered.	Update the trigger condition expression in the alarm policy based on the error message. For more details, see trigger conditional expression.
AlarmNotifyGroupNotExist	No notification group (%s) exists.	The notification group you selected has been deleted.	Create a new notification group and bind it to the alarm policy.
ErrAlarmUserDefineMsgParseErr	Failed to parse user-defined notification content: %s	The notification content you entered contains a grammar error.	Modify the notification content in the alarm policy according to the error prompt. For syntax details about notification content, see Content variable, Login-free access to the alarm details page, overview.
ErrAlarmWebhookBodyParseErr	Failed to parse the request body of the webhook in %d place in notification group (%s): %s	The syntax of the WebHook request body you entered is not correct.	Modify the WebHook request body according to the error prompt.
ErrAlarmCallWebhookErr	The webhook address in %d place in notification group (%s) is incorrect.	Failed to call WebHook address.	Check the availability of WebHook addresses in the notification group.
ErrAlarmContentTemplateParseErr	Content template (%s) failed to parse: %s	The content template you entered contains syntax errors.	Modify the content template according to the error message. For more details, see Create a content template.
ErrSendSmsMessageOutOfQuota	SMS from user %s exceeds limited quota.	The SMS notification frequency for the specified IAM user exceeds the quota.	Reference Alarm limits. Review the quota and try again later.
ErrMobileNotVerified	Phone number of user %s is not verified.	The mobile number configured in the specified IAM user's profile is not verified.	Go to the security settings page to complete mobile number verification for security
ErrSendVmsMessageOutOfQuota	User %s exceeds the phone limit.	The specified IAM user's phone notification frequency exceeds the limit.	ReferenceAlarm limits. Review the quota and try again later.
ErrEmailNotVerified	The email of user %s is not verified.	The email configured in the personal information of the specified IAM user has not been verified.	On security settings page, complete security email verification.
ErrSendSmsFail	User %s failed to send SMS: %s	Failed to send SMS notification.	Check your phone settings based on the error message and try again later.
ErrSendVmsFail	Failed to send voice notification to user %s: %s	Failed to send voice notification.	Check your phone settings based on the error message and try again later.
ErrSendEmailFail	Failed to send email to user %s: %s	Failed to send email notification.	Check your email settings according to the error message and try again later.
ErrWebhookIntegrationNotExist	The alarm webhook integration (%s) does not exist	The WebHook integration configuration you set has been deleted.	Recreate the WebHook integration configuration and bind the new WebHook integration configuration to your notification group.
ErrCallWebhookIntegration	Failed to call the alarm webhook integration (%s). Error code: %v. Error message: %s	Failed to call the WebHook address; the HTTP status code displays success; but sending alarm notifications to Feishu, DingTalk, and WeCom failed.	Check and update the WebHook integration configuration based on the error message, and then try again later.
AlarmDefaultErr	The alarm test failed. Try again later	None	Try again later.

Last updated: 2026.06.25 17:33:46