The alert management system is an alerting subsystem of Simple Log Service (SLS). It deduplicates, merges, and silences incoming alerts, then routes them to the notification management system—reducing noise and helping teams focus on what requires action.
Architecture
The alert management system sits between the alerting and monitoring system and the notification management system. Incoming alerts pass through an orchestration pipeline—deduplication, merging, silencing, and suppression—before notifications are dispatched. The system also includes an Alert Center module for managing incidents and viewing operational dashboards, including the Alert Pipeline Center and Alert Rule Center.
The following figure shows the architecture of the alert management system.
Alert policies
An alert policy is the core configuration entity in the alert management system. When the system receives an incident or a recovery notification, it applies the matching alert policy to perform denoising operations automatically.
-
Merging alerts
Merging groups alerts that share similar attributes into a single notification. This reduces redundant notifications during alert storms and simplifies downstream processing. For example, dozens of alerts firing on the same service can be merged into one grouped notification. For more information, see Merge multiple alert groups.
-
Silencing alerts
Silencing suppresses alert notifications for a defined time window. This is useful during planned maintenance: when a staging environment is taken offline, silencing prevents the resulting alerts from reaching on-call engineers. For more information, see Alert silence mechanism.
-
Alert policy inheritance
Alert policies support parent-child inheritance. A child policy inherits its parent's configuration, and the effective policy applied to an alert is the union of both. This lets you define common denoising rules at the parent level and override specific settings in child policies. For more information, see Alert policy inheritance mechanism.
-
Data isolation
Each alert policy has its own isolated data scope. Alerts and denoising state are not shared across policies, so changes to one policy do not affect others.