Alerting
Alerting is the generation and delivery of notifications when monitored conditions or events meet defined criteria or require attention or action.
Amazon Web Services in Action, Third Edition: An in-depth guide to AWS
A CloudWatch alarm is a monitoring rule that evaluates metrics against configured conditions and can initiate actions when those conditions are met.
- How it is used
- Uses metric thresholds to notify operators, recover failed EC2 instances, or initiate capacity changes.
- How deep it goes
- Walks through console alarm settings and shows CloudFormation recovery configuration, without detailing CloudWatch’s internal evaluation mechanism.
- Examples
- Uses a scheduled website health check, an EC2 recovery alarm, and CPU-based scaling to illustrate different responses.
- What you can do after
- Operate/configure it through the CloudWatch console for email alerts or CloudFormation for EC2 recovery.
Read how Amazon Web Services in Action, Third Edition: An in-depth guide to AWS explains alerting →
100 SQL Server Mistakes and How to Avoid Them
Alerting is the automated notification of personnel or systems when an event requires investigation or corrective action.
- How it is used
- Provides proactive notification of data-tier failures and high-priority security events requiring investigation or corrective action.
- How deep it goes
- Explains log-based checks, SQL Server Agent history, built-in alerts, and a DDL-trigger security signal without detailing monitoring-platform configuration.
- Examples
- Uses Populate_Fact_Tables job history and a trigger that logs an attempted xp_cmdshell configuration change as error 50001.
- What you can do after
- Operate/configure it by selecting recorded error signals and routing SQL Server or enterprise-monitoring notifications to responsible responders.
Read how 100 SQL Server Mistakes and How to Avoid Them explains alerting →
Cloud Observability in Action
An alert is a notification or triggered condition indicating that a monitored service or infrastructure condition requires attention.
- How it is used
- Automates detection and notification when monitored services or infrastructure behave abnormally.
- How deep it goes
- Defines alerting, baselines, and monitoring approaches, then surveys Prometheus, Grafana, and cloud-provider offerings without implementation detail.
- Examples
- Uses endpoint checks, simulated user journeys, CloudWatch alarms, Azure Monitor Alerts, Google Cloud alerting, SNS, and Pub/Sub.
- What you can do after
- Operate alerting by selecting monitoring checks, establishing baselines, and routing notifications to responsible owners.
MongoDB 8.0 in Action, Third Edition
An alert is a configured notification generated when a monitored database, user, account, or deployment condition is met.
- How it is used
- Notifies administrators when configured Atlas conditions indicate performance, capacity, or security problems.
- How deep it goes
- Explains conditions, sample thresholds, delivery channels, and CLI creation and inspection; does not detail notification-service setup.
- Examples
- Shows CPU steal, queue, query-targeting, and connection thresholds alongside an Atlas CLI email-alert command.
- What you can do after
- Operate/configure it: create a metric alert with the Atlas CLI, inspect alert settings, and route notifications for response.
Read how MongoDB 8.0 in Action, Third Edition explains alerting →
Apache Kafka in Action
An alerting mechanism is a system function that detects specified conditions and notifies operators when they occur.
- How it is used
- Turns Kafka monitoring metrics into notifications that help operators respond to anomalies before service disruptions grow.
- How deep it goes
- Explains metric selection, smoothing, threshold tuning, and notification context, but does not provide alert-rule commands or configuration.
- Examples
- Uses brief CPU spikes, Kubernetes container restarts, and consumer lag alongside produced-record counts to distinguish noisy signals from actionable problems.
- What you can do after
- Practice/perform alert selection and response by setting meaningful thresholds, reducing false alarms, and adding troubleshooting context.
Machine Learning Platform Engineering
Alerting is the process of generating and delivering notifications when monitored application, system, or infrastructure conditions require attention.
- How it is used
- Supports proactive incident management by notifying responsible teams about reliability, performance, security, drift, or cost problems.
- How deep it goes
- Builds rules, durations, labels, annotations, routing, grouping, and email delivery, but does not detail notification channels beyond configuration examples.
- Examples
- Uses BentoML uptime rules, absent-metric detection, Gmail routing, grouped notifications, and budget alerts for production LLM costs.
- What you can do after
- Operate/configure Prometheus and Alertmanager to detect service failures and route grouped notifications to email.
Read how Machine Learning Platform Engineering explains alerting →
Delivering Machine Learning Projects: From design to deployment
Alerting is the generation and delivery of notifications when monitored conditions indicate an issue or threshold violation.
- How it is used
- Supports production acceptance and technical operations by notifying teams about system failures and model-behavior changes.
- How deep it goes
- Explains event capture, functional and nonfunctional monitoring, notification timing, and cost trade-offs without specifying alert thresholds or tooling.
- Examples
- Uses unreachable databases, out-of-order pipeline steps, extreme values, and obsolete music-sales predictions as failure cases.
- What you can do after
- Operate/configure production support by connecting tests and monitoring to notifications for rapid diagnosis and response.
Read how Delivering Machine Learning Projects: From design to deployment explains alerting →
Microsoft Azure in Action
A smart alert is an automated monitoring notification that can use metrics, logs, or dynamic thresholds to identify and report problems.
- How it is used
- Detects operational, security, and governance problems early, then notifies people or starts automated responses.
- How deep it goes
- Explains alert types, dynamic thresholds, portal configuration, action groups, and security triage without detailing every deployment option.
- Examples
- Uses VM CPU anomalies, repeated login failures, public RDP exposure, deleted VMs, and WordPress theme vulnerabilities as alert examples.
- What you can do after
- Configure Azure Monitor rules that notify teams or invoke webhooks, Azure Functions, and automation runbooks.
Architecting an Apache Iceberg Lakehouse
Alerting is the automated generation and delivery of notifications when monitored data satisfies configured conditions.
- How it is used
- Uses operational metrics to detect Iceberg maintenance failures and emerging performance or storage problems.
- How deep it goes
- Connects metadata queries to emitted metrics and alerts, but stops short of specifying alert rules or delivery configurations.
- Examples
- Uses snapshot age, delete-file counts, uncompacted-file size, small-file counts, and compaction failure logs.
- What you can do after
- Operate maintenance workflows with dashboards, trend tracking, and alerts driven by custom metrics.
Read how Architecting an Apache Iceberg Lakehouse explains alerting →
Cyber Threat Hunting
A security alert is a notification that recorded activity matches conditions associated with potentially suspicious or malicious behavior.
- How it is used
- Supports reactive SOC triage while feeding suspicious activity into threat-hunting investigations.
- How deep it goes
- Explains alert routing and evidence collection, then demonstrates Windows process auditing with Event 4688 and audit-policy commands.
- Examples
- Uses decoy interactions, SOC alert triage, Windows Event 4688 records, and process-creation audit-policy commands.
- What you can do after
- Operate/configure alerts, route them for triage, and investigate process activity using Windows Event 4688 or EDR telemetry.
Related concepts
- monitoringused by · Monitoring is the ongoing observation and measurement of a system’s behavior, state, or operational signals to assess its condition and detect changes or problems.
- metricuses · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.
- Alertmanagerused by · Alertmanager is a Prometheus component that groups, routes, silences, suppresses, and delivers alerts to notification channels.
- PromQLuses · PromQL is Prometheus’s query language for selecting, filtering, aggregating, transforming, and analyzing multidimensional time-series metrics.
- Prometheusconfigured by · Prometheus is an open-source monitoring and alerting system that collects, stores, and queries time-series metrics.
- thresholdconfigures · A threshold is a boundary value against which a quantity is compared to determine whether a condition is met or an action or decision is triggered.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.