Docs

Torch Log Service

Alarm policy

Timeliness of alarm monitoring task

TLS alarm monitoring tasks are triggered based on the results of query and analysis, which involves the query time range and the execution time of the monitoring tasks. Proper time settings improve the timeliness of monitoring tasks and help prevent missed or false alarms. This topic descries the timeliness of alarm monitoring tasks and provides recommendations for setting time configurations.

Timeliness description

There is a short time lag between log writing, querying, and index building, which may lead to missed or false alarms. The details are as follows:

Delay occurs between log writing and querying

There is a delay between writing logs to log topic and the logs being available for query. Although this delay is minimal, it can still result in missed logs during searches. Therefore, when creating an alarm policy, it is not recommended to use the same relative time for the query time range and monitoring period. For example, provided that monitoring period is set to run every 1 minute and the query time range covers the past minute, then: if the execution time of a specific alarm monitoring task is 10:30:30, the corresponding query time range would be [10:29:30, 10:30:30]. Note that, due to time delay, logs written at 10:30:29 may not be available for query in the task executed at 10:30:30, which may lead to alarm discrepancies.

Low latency in index construction

Index construction for logs has low latency. When you write logs within the same minute but at different seconds, the index data for later logs may be written to an earlier time point. For example, if you set the monitoring interval to run every minute and the query time range to the past minute, a specific alert monitoring task executed at 10:30:30 would query the time range [10:29:30,10:30:30]. If you write multiple logs at 10:29:40, with timestamps such as 10:29:20 or 10:29:40, the index data for this batch may be written at 10:29:20. As a result, these logs will not be queried during the task at 10:30:30, which may cause alert discrepancy.

Time configuration recommendations

Assuming the monitoring interval is set to run every minute, configure an appropriate query time range for different scenarios.

The accuracy of alarms is critical, and repeated alarms and missed alarms are not allowed.

It’s recommended to shift the start and end of the query time range back by one minute, such as querying from two minutes ago to one minute ago. For example, if the alert monitoring task runs at 10:30:30, the query time range would be [10:28:30,10:29:30].

If you need alerts to trigger in real time and prioritize timely alerts, but duplicate alerts are acceptable.

We recommend moving the start time of the query range forward by 1 minute to extend your search window, for example, from 2 minutes ago to now. For instance, if the alarm monitoring task runs at 10:30:30, set your query range as [10:28:30, 10:30:30].

Last updated: 2026.04.24 16:23:58