The Simple Log Service alert management system automatically deduplicates alerts by using fingerprints. Alerts that share the same fingerprint are treated as a single alert: the system retains one and discards the rest.
Fingerprint attributes
The alert management system calculates a fingerprint for each alert based on four attributes:
| Attribute | Description |
|---|---|
aliuid |
The ID of the Alibaba Cloud account to which the alert monitoring rule belongs. Alerts from different accounts always have different fingerprints. |
project |
The Simple Log Service project to which the alert monitoring rule belongs. Alerts from different projects always have different fingerprints. |
alert_id |
The ID of the alert monitoring rule. Alerts from different rules always have different fingerprints. |
labels |
The alert labels (key-value pairs). Labels distinguish alerts that originate from the same rule but apply to different dimensions, such as different hosts or services. |
Two alerts share the same fingerprint only when all four attributes match. If any attribute differs, the alerts are treated as distinct and both are retained.
The annotations field, which contains metadata such as the alert title and description, is not part of the fingerprint. Two alerts can have different annotations but still be deduplicated if their four fingerprint attributes are identical.
Example
Suppose an alert monitoring rule generates the following three alerts:
// Alert1
{
"aliuid": "12345",
"project": "Project1",
"alert_id": "alert-123",
"labels": {
"host": "host-1"
},
"annotations": {
"title": "High CPU utilization",
"desc": "The current CPU utilization is 90%."
}
}
// Alert2
{
"aliuid": "12345",
"project": "Project1",
"alert_id": "alert-123",
"labels": {
"host": "host-1"
},
"annotations": {
"title": "High CPU utilization",
"desc": "The current CPU utilization is 95%."
}
}
// Alert3
{
"aliuid": "12345",
"project": "Project1",
"alert_id": "alert-123",
"labels": {
"host": "host-2"
},
"annotations": {
"title": "High CPU utilization",
"desc": "The current CPU utilization is 90%."
}
}After deduplication, the system retains Alert1 and Alert3, and deletes Alert2:
| Comparison | aliuid | project | alert_id | labels | Fingerprint match? | Result |
|---|---|---|---|---|---|---|
| Alert1 vs Alert2 | Same (12345) |
Same (Project1) |
Same (alert-123) |
Same (host: host-1) |
Yes | Alert2 is deleted |
| Alert1 vs Alert3 | Same (12345) |
Same (Project1) |
Same (alert-123) |
Different (host-1 vs host-2) |
No | Both are retained |
Alert1 and Alert2 differ only in the annotations.desc field (90% vs 95%). Because annotations are not part of the fingerprint, these two alerts have the same fingerprint and are deduplicated. Alert1 and Alert3 have different labels values, so they have different fingerprints and both are retained.