Skip to main content
Sumo Logic

Monitor FAQ

Can I convert my existing scheduled search or Metrics monitors to the new monitors?

Yes, you can move your existing scheduled searches or metrics monitors to a new Monitor. Currently, that process of moving is manual. You will have to create a new Monitor with the appropriate query and alerting condition based on your existing Scheduled Search or Metrics monitor.

I am unable to see the new Monitors tab?

Monitors Tab appears under Manage Data > Alerts > Monitors. If you don’t see it, then you might be in a role that doesn't have permission to access the Monitors page. Ask your admin to provide you with View or Manage Access for the Monitor page.

Does Auto Resolution work with all different types of Connections?

Auto Resolution is currently supported with Email, OpsGenie, PagerDuty, and Slack connections. Support for other connection types is coming soon.

If an incident persists for a long time, will I get bombarded with repeated notifications?

Sumo Logic’s new monitors are intelligent, each monitor keeps track of the notifications that are sent out, and won't send additional notifications after sending the first one if the incident persists. It will, however, send additional notifications if there is a major change in the state of the monitor, such as new triggers from Warning to Critical.

I am getting an error message about cardinality when creating metrics monitor, what does it mean?

Metrics monitors can evaluate up to 15K time series. If your Monitor query returns more than 15K time-series you'll get this error. If you are facing this, we recommend breaking up the monitor into several smaller ones with more restrictive queries. See OpenTSDB documentation for details on cardinality

For example, instead of creating one monitor to alert on CPU utilization, break it up into one monitor per deployment or service. This will also give you more flexibility in setting more customized thresholds & help reduce alert noise.

Why does my monitor get automatically disabled? 

Sumo Logic will automatically disable a Monitor if it violates specific limitations. You can check the reason it was disabled with the Audit Event Index. The following query will search the Audit Event Index for the reason:

    _index=sumologic_system_events MonitorSystemDisabled <monitorId>

You need to replace <monitorId> with the ID of the Monitor.

A common reason a metric Monitor is disabled is the Cardinality Limit was exceeded. This happens when your metrics Monitor query returns more than 15,000 timeseries, since we support up to 15,000 timeseries in a single Monitor. For example, if you use Kubernetes and have 20,000 pods in your deployment, a query that spans all pods, like the following, will result in the cardinality error.

deployment=acme metric=container_cpu_usage_seconds_total | rate | sum by pod

How to fix it

Break your Monitor into several monitors. 

Based on the above Kubernetes example, if you are collecting Kubernetes data from different AWS regions, instead of creating a single alert on all pods across all AWS regions, create one alert per AWS region, as shown below:

Monitor 1 query:

deployment=acme region=us-west2 metric=container_cpu_usage_seconds_total | rate | sum by pod

Monitor 2 query:

deployment=acme region=us-east1 metric=container_cpu_usage_seconds_total | rate | sum by pod

And so on.

Can I use “Save to Index” or “Save to Lookup” for Log Monitors, just like I can for Scheduled Searches?

No, Log Monitors don't support these options. 

Are Search Templates supported in Log Monitors?

No, Search templates are not supported in log monitors. 

What happens when a trigger condition continues to be met for many days. Such as missing data for a couple of days.

After one day if there is no update to an incident, the system automatically expires it. The incident is marked as resolved with the resolution set to Expired.

What happens when more than one Trigger Condition is met? Will I get multiple notifications? 

There are two cases when this can happen. 

  • When both Critical & Warning conditions are met two separate notifications are generated, one for the Critical condition and one for the Warning condition. Auto resolution, if set up, will work according to the resolution condition for each case.  
  • When the Missing Data condition is met after initially firing a critical/warning incident the system will resolve the Critical/Warning incident that was created with the appropriate Resolution reason. The system will also create a new Missing Data incident and notify you appropriately using your configured notification channel. 
Can I reference my monitor configuration to customize the notification being sent out?

Yes, you can use Alert Variables to reference various monitor configurations in your custom payload.

One of our monitors suddenly stopped sending notifications, even though I see it on the Monitors page?

One of the reasons could be that the user who created the monitor was deleted. You can check the Created By value on the Monitors page. If it has <User Unknown> you will need to re-create the monitor.
user unknown monitors.png

You can quickly Duplicate the monitor by hovering over it on the Monitors page and clicking the three-dot icon,
more actions menu for monitors.png
then selecting Duplicate. If your monitor still doesn't work then it might be a different problem. Please contact customer support

Can I disable a Monitor during scheduled maintenance or upgrade window?

The Monitors page allows you to disable a Monitor so you're not alerted during specific times like scheduled maintenance or upgrade windows. Follow the below steps to disable a monitor. 

  1. Find and select the Monitor in the Monitors table. A three-dot icon appears on the right of the row.

  2. Click the three-dot icon to view the menu options. You can select to Enable or Disable the monitor.