Violations not creating incidents / events

Hi guys,
I looked up similar questions about violations but still could not find a solution to my issue. I tried many combinations of offset / aggregation values and all types of Incident preferences (By Policy, By condition, By condition and entity)

I have a simple NRQL for monitoring my data usage, i see a critical violation in the Alert Condition no incident / event is created (when i go to “All Incidents” - its empty)

Any ideas?


Hi @playermaker, would it be possible for you to share links to the exact conditions that are not working for you?

Only new Relic Employees will be able to view these.

1 Like

This is the ones for data usage:
I tried “at least once in” condition[0]=eyJuZXJkbGV0SWQiOiJucmFpLm5hdmlnYXRpb24tYmFyIiwibmF2IjoiUG9saWNpZXMifQ==&platform[accountId]=3063418

and also “for at least” condition:[0]=eyJuZXJkbGV0SWQiOiJucmFpLm5hdmlnYXRpb24tYmFyIiwibmF2IjoiUG9saWNpZXMifQ==&platform[accountId]=3063418

also tried a completely different query for 0 log lines in 60 min just to test[0]=eyJuZXJkbGV0SWQiOiJucmFpLm5hdmlnYXRpb24tYmFyIiwibmF2IjoiUG9saWNpZXMifQ==&platform[accountId]=3063418

none of them creates an incident

Thank you!

Thanks for sharing those @playermaker. I’m going to see if I can get a technical support engineer to take a look at this.

1 Like

Hey , any update on this topic? we still dont get any alert about anything and we have to monitor things manually, which defeats the whole purpose of using this platform

:slight_smile: Thanks

Hi @playermaker

Preview graphs in alert conditions don’t actually show what is being evaluated, but instead show what data is stored in NRDB. A graphical overlay shows where violations would happen, but the preview graph is by no means an indicator of what the condition is actually evaluating.

In this case, the data is coming in too late for the condition to evaluate. This article goes into more detail on how latent data can affect your alert condition evaluation.

Usage metric events like NrMTDConsumption are posted late, and so your condition will need a much greater Evaluation Offset to account for that. At the moment, your alert condition is failing to evaluate any data because it’s all coming in much later than the evaluation time.

As you will notice in this doc, you should set Evaluation Offset to 60 minutes whenever configuring an alert condition on usage data.

Will you please try that and let us know if you’re still encountering difficulties after the change is made?

1 Like

Hi @Fidelicatessen , thank you so much for your detailed response!
I will try and post a comment once i have the results


This topic was automatically closed after 365 days. New replies are no longer allowed.