Alert condition dynamic threshold

Dynamic Threshold is a feature that removes the need to manually define a fixed threshold value.

Once enabled, the system continuously monitors whether metric values fall outside this learned normal range. If a deviation is statistically significant, an alert is triggered. Values that remain within the expected range — even if they appear high in absolute terms — will not fire an alert, reducing noise and helping you focus on genuine issues.

For example, if CPU use reliably climbs every morning during peak usage, Dynamic Threshold recognizes this as expected behavior and does not alert during that window. However, if a similar spike occurs at an unusual time or exceeds the learned upper bound, an alert is triggered.

When Dynamic Threshold is enabled on an alert condition, a training process begins. The system collects historical metric data and builds a model that accounts for recurring patterns — including hourly, daily, and weekly cycles. The model is continuously refined as more data becomes available, and it adapts to changes in normal system behavior over time.

The model requires a minimum period of historical data before it can begin triggering alerts.

Note: For best results, at least 21 days of metric history is recommended. This allows the model to accurately detect weekly seasonal patterns in addition to hourly and daily trends.

When to use Dynamic Threshold

Dynamic Threshold delivers the most accurate results with gauge-based metrics — metrics that continuously reflect the current state of a system at a point in time. These metrics form stable time series that the model can accurately baseline. Hence, measurable metrics, like percentage, time, temperature, or storage space are ideal.

Counter-based, aggregate, or binary metrics do not represent a continuous, predictable state over time. The model may fail to establish a meaningful baseline, which can lead to false alerts or missed detections. For these metric types, a static threshold is recommended for more reliable alerting behavior.