Alerts Report

The Alert report returns a list of all alerts, which can include every individual alert that matches the parameters or a count of the number of times each alert occurred during a specified time period. By reviewing these non-critical alerts in a report, you can reduce the number of alerts you need to be notified of and gain additional insight by seeing alerts in context with other alerts.

You can use an Alert report to do the following:

• Review all the alerts for those resources in scheduled downtime (SDT) and address potential issues before SDT ends.
• Identify alerts that have been active for a long period of time and then tune your thresholds to reduce future occurrences of similar alerts.
• Evaluate how long it takes for users to acknowledge alerts.
• Deliver a daily report that includes all alerts from the past 24 hours.
  The report can show you how much a threshold was exceeded, enabling you to determine which thresholds need adjusting.
  In addition, You can use this daily report to determine if alert notifications should be routed to email, text, and so on, and adjust your alert rules.
• View historical SDT information for your resources to understand whether an alert was generated for a specific resource that was put into SDT for the configured timeframe of the report.

When you configure an Alert report, you configure settings that determine the alerts that are included in the report. For example, you can exclude or include preexisting alerts. A Report Preview displays as a panel to provide you with a preview of what the report will look like when generated. It displays all the alerts that match the settings you configured. You can apply additional filters in the Report Preview to further filter the alerts as needed.

You can choose to generate the report on a schedule or ad-hoc.

Requirements for Configuring an Alert Report

To configure an Alert report, you need a user with “View” and “Manage” for the Reports role permissions. For more information, see Reports Role Permissions.

Configuring an Alert Report

1. In LogicMonitor, navigate to Reports.
2. Select  > Add Report > select Add for the Alert report.
   
3. In the Name field, enter a name for the report.
   Report names cannot include the operators and comparison functions used in LogicMonitor’s datapoint expression syntax.
4. (Optional) In the Description field, enter a description for the report.
   For example, you can enter a description of the specific purpose of the report.
5. From Report Group, select the report group where your report is stored.
   Matching groups display as you type, and you can select the group from the list.
6. From Format, select the type of format for the output of the report.
   You can select HTML, PDF, or CSV.
   
7. To include alerts prior to the specified date range, but meet all other criteria, toggle Include preexisting alerts.
   The Report Preview panel updates to include or remove alerts based on status of the toggle.
8. To add a column to the Alert report that details the frequency that an alert occurred during the report time range, toggle Summarize alert counts.
   This enables you to sort the report by “Alerts” to see the top sources of alerts. You can remediate highly impactful issues or tune datapoint thresholds as needed.
   
9. From Sort By, select an option to sort the alerts.
   

   Note: The options in the Sort By settings are dependent on the status of the Summarize alert counts setting.

   The Report Preview panel updates to reflect the sorting option.

   Note: Selecting “Severity” automatically sorts by the time the alert began in descending order, similar to the Alerts page. This enables you to sort on both the alert severity level and the time the alert began.

10. To sort the alerts, do one of the following:
    • To sort the alerts in ascending order, select ACS.
    • To sort the alerts in descending order, select DECS.
11. In Report Schedule settings, do the following to configure the report to generate on a schedule:
    1. Toggle Generate this report on a schedule.
    2. From Frequency, select how frequent you want the report to generate, and then configure when you want the report to generate.
       For example, if you configure the report to generate daily, you can choose the time to generate the report each day. If you configure the report to generate weekly, you can choose the day of the week and time to generate the report for the selected date. If you configure the report to generate monthly, you can configure the day of the month and time to generate the report.
       Each frequency option provides you a setting for selecting the time zone.
    3. In Recipients Email, enter the name of the user you want to receive the generated report. You can also add recipient groups.
       You can enter as many users as needed.
       LogicMonitor attempts to match values as you type.
       The recipients you add to the report are emailed a generated report based on the format you configured and the email associated with the username.
       

12. In the Report Preview panel, use the following to include or exclude alerts as needed:
    • Severity Levels—You can sort the report based on the severity level (for example, “Critical,” “Error,” or “Warning”).

      Note: Sorting the Alerts report by severity automatically enables secondary sorting by time began (in descending order). This secondary sorting functionality is similar to the functionality available from the Alerts page, allowing you to simultaneously sort on both the alert severity level (primary sort) and the time the alert began (secondary sort). For more information, see Managing Alerts from the Alerts Page.

    • Filters—You can select the filters for the alerts displayed in the report using a variety of criteria (for example, resource, instance, datapoint, severity level, and so on). As you set filter criteria, the alerts displayed in the Report Preview automatically updates.

      Recommendation: A maximum of 30,000 alerts are returned in a report. If more than 30,000 alerts match your filter criteria, the resources or groups with the most alerts are automatically excluded from the report. To avoid the issue, ensure to sufficiently narrow your filters.

    • Clear—You can clear the applied filters.
    • Time Range—You can select the duration of time you want the report based on.
    • Column Settings—You can reorder columns or add custom columns as needed for your report.

      Note: LogicMonitor supports the addition of columns that represent properties or custom tokens.

13. To save the report, do one of the following:
    • The report saves to the Report Group you selected.
      If you configured the report to generate on a schedule, the report generates and sends to recipients based on the frequency you configured.
    • Select Save and Run.
      The report saves to the Report Group you selected and generates a report based on the format you configured.
      If you configured the report to generate on a schedule, the report generates and sends to recipients based on the frequency you configured.

Threshold Limits

Adhoc Requests Thresholds (Limit for number of items)

CSV	HTML	PDF
85000	30000	2000

Scheduled Requests Thresholds

CSV	HTML	PDF
720000	30000	4000