gcp monitoring "Any time series violates" vs "All time series violate"

Question

What's the difference between the two options "Any time series violates" and "All time series violate"? I can imagine what would the former one do easily, but I have no idea what would the latter one do.

All time series? how long is its range? and why does it have a for option?

Guss

Answer 1

What's the difference between the two options "Any time series violates" and "All time series violate"? I can imagine what would the former one do easily, but I have no idea what would the latter one do.

First, what is "time series violates" - its when CURRENT VALUE of metric is outside of expected range, e.g: above the threshold specified.

Second, "any/all/percent/number" - let's say you have 5 time series, e.g.: cpu usage on 5 instances, then per dropdown options the whole alert condition will violate when:

• "any time series": any 1 of the time series is in violation
• "all time series": all 5 of the time series are in violation
• "percent of time series" (40%): 2 out of 5 of the time series are in violation, and yes, selecting 39% or 41% on small numbers will give you different results, so
• "number of time series" (3): 3 out of 5 of the time series are in violation

Third, for aka Duration box, - it looks like "if my time series violates FOR 5 minutes, then violate the condition". And for some simpler alerts this can even work, but once you try to combine it with say, "metric is absent" or other complicated configuration, you will see that what actually happens is "wait for 5 minutes after the problem is there, and only then trigger the violation".

In practice, the use of for field is discouraged and its better to keep it on default "Most recent value".

If you do need the "cpu usage is above 90% for 5 minutes", then correct way of doing it is by denoizing/smoothing your data:

• set alignment period to 5 minutes (or whatever is the sliding window that you want)
• then choose reasonable aligner (like, mean which will average the values)
• and then while the chart will have less datapoints, they would be less noisy and you can act upon the latest value.

Convery

What may not be super obvious is that this only applies when you actually have multiple time series (lines). If you only have a single time series (a single line), this does nothing. I wish the UI would disable this when there's only a single time series, since it has no effect, and is confusing that you can even change it with a single time series. – Saintmihiel

Answer 2

Any time will trigger if there is a violation of any time series, inside the window chosen on "for".

Let's say there is 5 time series, it will trigger if there is a violation in one of them.

For the all time series, it will trigger if it happens 5 out of 5.

Arand

Answer 3

I'm having a different case in my one gcp project I'm getting the alert trigger condition option of ' Any time series Violates" but in my other project I'm getting option"Any time series Violation".

first one in the first project is not working but second one in second project is working. don't know why I'm having different field options in projects for same field.

Toluate

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Mushy