Skip to main content
Sumo Logic

Monitor FAQ

Can I convert my existing scheduled search or Metrics monitors to the new monitors?

Yes, you can move your existing scheduled searches or metrics monitors to a new Monitor. Currently, that process of moving is manual. You will have to create a new Monitor with the appropriate query and alerting condition based on your existing Scheduled Search or Metrics monitor.

Will Scheduled Searches and Metrics Monitors be deprecated in the future with the introduction of new Monitors?

There are no immediate plans to deprecate metrics monitors or Scheduled Searches from Sumo Logic. Those features will continue to work along with the introduction of new Monitors. 
As mentioned in About Monitors, Scheduled Searches solve two different use cases, Alerting and Reporting, while Monitors are designed to solve the alerting use case. Therefore Scheduled Searches will remain available along with Monitors in the future to solve the reporting use case.

We do however encourage you to leverage the new Monitors for your monitoring and alerting use cases. 

I am unable to see the new Monitors tab?

Monitors Tab appears under Manage Data > Alerts > Monitors. If you don’t see it, then you might be in a role that doesn't have permission to access the Monitors page. Ask your admin to provide you with View or Manage Access for the Monitor page.

Does Auto Resolution work with all different types of Connections?

Auto Resolution is currently supported with Email, OpsGenie, PagerDuty, and Slack connections. Support for other connection types is coming soon.

If an incident persists for a long time, will I get bombarded with repeated notifications?

Sumo Logic’s new monitors are intelligent, each monitor keeps track of the notifications that are sent out, and won't send additional notifications after sending the first one if the incident persists. It will, however, send additional notifications if there is a major change in the state of the monitor, such as new triggers from Warning to Critical.

I am getting an error message about cardinality when creating metrics monitor, what does it mean?

Metrics monitors can evaluate up to 15K time series. If your Monitor query returns more than 15K time-series you'll get this error. If you are facing this, we recommend breaking up the monitor into several smaller ones with more restrictive queries. See OpenTSDB documentation for details on cardinality

For example, instead of creating one monitor to alert on CPU utilization, break it up into one monitor per deployment or service. This will also give you more flexibility in setting more customized thresholds & help reduce alert noise.

Can I use “Save to Index” or “Save to Lookup” for Log Monitors, just like I can for Scheduled Searches?

No, Log Monitors don't support these options. 

Are Search Templates supported in Log Monitors?

No, Search templates are not supported in log monitors. 

What happens when a trigger condition continues to be met for many days. Such as missing data for a couple of days.

After one day if there is no update to an incident, the system automatically expires it. The incident is marked as resolved with the resolution set to Expired.

What happens when more than one Trigger Condition is met? Will I get multiple notifications? 

There are two cases when this can happen. 

  • When both Critical & Warning conditions are met two separate notifications are generated, one for the Critical condition and one for the Warning condition. Auto resolution, if set up, will work according to the resolution condition for each case.  
  • When the Missing Data condition is met after initially firing a critical/warning incident the system will resolve the Critical/Warning incident that was created with the appropriate Resolution reason. The system will also create a new Missing Data incident and notify you appropriately using your configured notification channel. 
Can I reference my monitor configuration to customize the notification being sent out?

Yes, you can use Template Variables to reference various monitor configurations in your custom payload. See Template Variables for details.

Can I disable a Monitor during scheduled maintenance or upgrade window?

The Monitors page allows you to disable a Monitor so you're not alerted during specific times like scheduled maintenance or upgrade windows. Follow the below steps to disable a monitor. 

  1. Find and select the Monitor in the Monitors table. A three-dot icon appears on the right of the row.

  2. Click the three-dot icon to view the menu options. You can select to Enable or Disable the monitor.