Cloud HSM tracks the health, performance, and load of your Hardware Security Module (HSM) instances and clusters in real time. Set alert rules to get notified immediately when anomalies occur so you can act before they affect your workloads.
Monitoring coverage
Cloud HSM provides two categories of monitoring:
Category | Metrics | Availability | Proactive Alerting |
Basic Monitoring | CPU usage, memory usage, TCP connections, HSM health, cluster synchronization status | All regions | Supported (built-in rules and custom rules) |
TPS monitoring | Transactions Per Second (TPS) for symmetric algorithms, SM2, RSA, ECC, and hash operations | Chinese mainland HSM instances only | Not supported — use custom rules in CloudMonitor |
Monitoring applies at two levels:
Instance — Tracks resource usage and health of an individual HSM instance.
Cluster — Tracks synchronization status and aggregate TPS across all instances in a cluster.
Key benefits include:
Proactive risk alerts — Analyze metric trends to promptly identify potential operational risks. The integrated alerting mechanism notifies the relevant personnel of faults to help ensure business continuity and stability.
Fault diagnosis — When an anomaly occurs, detailed monitoring data helps you quickly find the root cause and reduce troubleshooting time.
View monitoring data
Metric data is retained for a maximum of 30 days. Data older than 30 days cannot be retrieved.
Go to the Security Audit page of the Cloud Hardware Security Module console. In the top navigation bar, select a region.
Click an instance ID to open the details page. The page displays the Instance Monitoring Information and Cluster Monitoring Information tabs.
Select a time range. Data granularity adjusts automatically based on the range you select:
Time range
Statistical period
1 hour, 3 hours, 6 hours, 12 hours
5 minutes
1 day
10 minutes
3 days
30 minutes
7 days
60 minutes
More than 7 days to 30 days
120 minutes
(Optional) Turn on Auto Refresh in the upper-right corner to pull the latest metric data every minute.
Monitoring metrics reference
Instance monitoring
Basic Monitoring
Infrastructure monitoring provides comprehensive alerting capabilities for all metrics. It supports both out-of-the-box Proactive Alerting rules and custom alert rules. The statistical period for Proactive Alerting rules is 5 minutes by default.
Metric | Description | Default Proactive Alerting rule |
CPU usage | CPU utilization of the HSM instance. | Alert level: Warning (WARN) |
Memory usage | Memory utilization of the HSM instance. | Alert level: Warning (WARN) |
TCP connections | Total established TCP connections for the HSM instance. | Alert level: Info |
HSM health | Running status of the HSM instance: 1 = Normal, 0 = Abnormal. When the value drops to 0, Cloud HSM automatically isolates the faulty instance to ensure service continuity and security. See HSM health is 0 for resolution steps. | Alert level: Warning (WARN) |
TPS monitoring
TPS monitoring is available only for HSM instances in the Chinese mainland. Proactive Alerting is not supported — configure custom alert rules in CloudMonitor instead.
Metric | Description |
Symmetric algorithms | TPS for symmetric algorithm operations (AES, SM1, SM4). |
SM2 | TPS for SM2 operations (key generation, encryption/decryption, signing/signature verification). |
RSA | TPS for RSA operations (key pair generation, public key operations, private key operations). |
ECC | TPS for Elliptic Curve Cryptography (ECC) operations (key pair generation, signing/signature verification). |
Hash algorithm | TPS for hash (digest) operations. |
Cluster monitoring
Basic Monitoring
Infrastructure monitoring provides comprehensive alerting capabilities for all metrics. It supports both out-of-the-box Proactive Alerting rules and custom alert rules in CloudMonitor. The statistical period for Proactive Alerting rules is 5 minutes by default.
Metric | Description | Default Proactive Alerting rule |
Synchronization Status | Whether the cluster is synchronized: 1 = Normal (digests of primary and secondary HSMs are consistent), 0 = Not synchronized (digest or configuration inconsistencies, or synchronization failure). | Alert level: Info |
TPS monitoring
Cluster TPS monitoring is available only when all instances in the cluster are HSMs in the Chinese mainland. Proactive Alerting is not supported — configure custom alert rules in CloudMonitor instead.
Metric | Description |
Symmetric algorithms | Aggregate TPS across all cluster instances for symmetric algorithm operations (AES, SM1, SM4). |
SM2 | Aggregate TPS across all cluster instances for SM2 operations (key generation, encryption/decryption, signing/signature verification). |
RSA | Aggregate TPS across all cluster instances for RSA operations (key pair generation, public key operations, private key operations). |
ECC | Aggregate TPS across all cluster instances for ECC operations (key pair generation, signing/signature verification). |
Hash algorithm | Aggregate TPS across all cluster instances for hash (digest) operations. |
Set up alerts
Cloud HSM offers two ways to configure alert rules. Use One-Click Alerting to activate the built-in rules immediately, or go to CloudMonitor for full customization.
Method 1: Enable One-Click Alerting (recommended)
One-Click Alerting activates the built-in Proactive Alerting rules for all Basic Monitoring metrics with a single switch. It is the fastest way to get coverage for the most critical HSM health signals.
Enabling One-Click Alerting applies the alert rules to all HSM instances under your Alibaba Cloud account.
If you previously enabled One-Click Alerting and modified the rules, enabling it again resets all rules to the system defaults.
Go to the Security Audit page of the Cloud Hardware Security Module console. Select a region.
Click an instance ID. On the Instance Monitoring Information or Cluster Monitoring Information tab, click Proactive Alerting in the upper-right corner.
Turn on the Proactive Alerting switch.
(Optional) Adjust individual rules: disable or modify rules for specific metrics if you need more granular control.
NoteThe default alert recipient is Default Alert Contacts (a system-created contact group). To update contact information, go to the CloudMonitor console. For details, see Modify an alert contact or a contact group.
(Optional) Enable alerts for missing data:
Click Proactive Alerting to open the CloudMonitor console and locate the target default alert rule.
In the Actions column, click Modify.
Set NoDataPolicy to Send alert notifications.
Setting NoDataPolicy to Send alert notifications prevents threshold evaluation from being skipped when metric data is absent, which ensures alerts fire reliably even during data gaps.
Method 2: Configure custom alert rules in CloudMonitor
Use CloudMonitor for TPS monitoring alerts, or when you need thresholds and notification channels beyond the built-in defaults.
On the Instance Monitoring Information or Cluster Monitoring Information tab, click Configure Alert Rules in the upper-right corner to go to the CloudMonitor console.
On the Alert Rule page, create a rule. For detailed steps, see Create an alert rule. Set the following fields:
Product: Select HSM Instance or HSM Cluster.
NoDataPolicy: Select Send alert notifications to ensure alerts fire even when metric data is temporarily absent. This option prevents threshold evaluation from being affected when metric data is empty, which ensures the timeliness and accuracy of alerts.
Handle alerts
HSM health is 0 (HSM instance is abnormal)
An HSM health value of 0 means the instance is not operating normally. Cloud HSM automatically isolates the faulty instance to ensure service continuity and security, but the root cause still requires investigation.
Common causes:
Hardware failure — Internal components (processors, memory, or cryptographic cards) are damaged or malfunctioning.
Software or firmware bugs — Errors in the device firmware, driver, or management software cause functional abnormalities.
Network connectivity issues — The connection between the application server and HSM is interrupted, unstable, or has high latency.
Power supply issues — Power interruptions or unstable voltage cause the device to shut down unexpectedly.
Abnormal operating environment — Excessive temperature, improper humidity, or poor ventilation affect device stability.
Resolution steps:
Check instance status — In the Cloud HSM console, confirm whether the instance status shows "Running". Also check the Alibaba Cloud status page or internal messages for any service failures or scheduled maintenance in the current region.
Check network connectivity — Review the security group and network ACL rules for the VPC where both the application server and HSM instance reside. Confirm that network access to the HSM service port is allowed.
High CPU or memory usage
Diagnose first: On the monitoring page, compare the CPU usage curve with the TPS monitoring curve for the affected time period.
CPU usage and TPS both spike — This is typically caused by a peak in service traffic. No immediate action is required unless the spike is sustained.
CPU usage is high but TPS is not — The application may be performing many complex key generation or asymmetric encryption/decryption operations.
Response:
Short-term: If the issue is caused by a sudden increase in service traffic, evaluate whether to temporarily add nodes to the cluster to distribute the load.
Long-term: If the cause is application call logic, optimize the code. For sustained capacity shortages, scale out your resources promptly.
Abnormal cluster synchronization status
For manually synchronized HSM clusters in the Chinese mainland, go to the instance list page and click Synchronize Cluster to trigger a manual synchronization.
Limitations
Constraint | Detail |
Data retention | Metric data is viewable and stored for a maximum of 30 days. |
TPS monitoring availability | Available only for HSM instances in the Chinese mainland. |
Cluster TPS monitoring availability | Available only when all instances in the cluster are HSMs in the Chinese mainland. |
Proactive Alerting for TPS metrics | Not supported. Configure custom alert rules in CloudMonitor. |