Alarm notifications in depth

An alarm rule tells people through its notify block. Without one, the alarm is recorded and shown, but nobody is notified. This page covers the block, when notifications go out, and the organisation-wide settings that protect people from floods.

The notify block

The block is set in the rule’s JSON mode (the form keeps it when you edit other fields). Threshold rules and the Device offline rule take the same block.

"notify": {
  "recipients": [
    { "kind": "role", "role": "ADMIN" },
    { "kind": "user", "userId": "6f1c2a9e-…" },
    { "kind": "email", "email": "oncall@example.com" }
  ],
  "channels": ["inapp", "mail"],
  "minSeverity": "MAJOR",
  "repeatEverySec": 1800
}

Field	Meaning	Limits
recipients	Who is told. Required in the block.	1 to 20 entries
channels	Restrict to these channel ids. Absent: every channel each recipient allows.	up to 8
minSeverity	Below this severity the alarm is recorded but nobody is told. Absent: every severity.	a severity
repeatEverySec	Remind while the alarm stays Open and unacknowledged. Absent: no reminders.	60 s to 7 days

Recipients

Kind	Example	Reaches
user	{ "kind": "user", "userId": "…" }	One active member of your organisation. A user who is not an active member is skipped.
role	{ "kind": "role", "role": "OWNER" }	Every active member with that built-in role (OWNER, ADMIN, USER), worked out when the alarm fires.
email	{ "kind": "email", "email": "noc@example.com" }	That address only, for example a shared on-call mailbox. No preferences or quiet hours apply.

• Members and roles are reached in the bell, by push and in their linked chat apps. E-mail goes only to email recipients: add the address explicitly when you want mail.
• Alarm rules cannot name teams, custom roles or phone numbers. For SMS, use a flow (see SMS notifications).
• A notification reaches at most 100 people after roles are expanded; the same person named twice is told once.
• There are no on-call rotations or escalation chains for IoT alarms. Use roles, reminders and severity rise.

Channels

Channel ids: inapp, mail, push, sms, and one id per connected chat platform. Naming sms has no effect for alarm recipients, who have no phone number in a rule.

When notifications go out

Alarm change	Notification	Title
Opened (not backfilled)	Yes, at or above minSeverity	“Severity alarm: title“
Severity rose	Yes	“Escalated to Severity: title“
Severity fell	No
Fired again at the same severity	No
Acknowledged	No
Resolved	Yes, if its opening was told	“Resolved: title” (“… resolved after n min.”)
Still open and not acknowledged	A reminder every repeatEverySec	“Still open: title“
Opened from late readings	Not at once; announced once if still open when live data returns	as Opened
Device muted	No; the timeline says Muted: nobody was notified

Reminders stop when someone acknowledges or resolves the alarm. The first reminder comes repeatEverySec after the alarm opened.

Each sent notification adds a Notified line to the alarm’s timeline, with the number of recipients and the channels.

Gates, in order

1. Minimum severity: below it, nothing.
2. Mute: a muted device notifies nobody. See Muting a device for maintenance.
3. Repeat window: the same change of the same alarm condition on the same device (opened, resolved, escalated to a given severity, a given reminder) is told at most once per window, 300 seconds by default. This stops a flapping device from paging on every cycle, even though each re-open is a new alarm. Held-back notifications show Notification held back (throttle) on the timeline.
4. Storm guard: see below.
5. Each recipient’s channels and preferences: see Your notification preferences.

Alarm storms

When many alarms fire at once (a site loses power, a network fails), individual notifications would bury the important ones.

• The organisation sends at most 20 alarm notifications per minute one by one (the storm threshold).
• Beyond that, alarm notifications are collected into a digest. Five minutes after the first collected one, each person who would have been told gets one digest: title “n new alarms”, text “n new alarms: 12 CRITICAL, 25 MAJOR.”, with a link to the open alarms.
• CRITICAL alarms still go out one by one during a storm, up to 60 per minute; beyond that they join the digest too.
• A digest that contains a critical alarm is sent as critical.

The critical bypass

With Critical alarms ignore notification preferences on (the default), a notification about a CRITICAL alarm (and its reminders, escalation and resolution) reaches recipients even when they switched that channel off or are in quiet hours. It does not reach channels the organisation turned off, blocked addresses, or channels without an address. The organisation-wide critical bypass of the notification service must also be on (it is by default).

Alarm settings

Administrators open Alarms > gear icon > Alarm settings (“Notification storms, repeats and how long resolved alarms are kept”):

Group	Setting	Default	Range
Notifications	Critical alarms ignore notification preferences	On
Notifications	Repeat window (seconds)	300	60 to 86,400
Alarm storms	Storm threshold (per minute)	20	1 to 10,000
Alarm storms	Critical alarms sent during a storm (per minute)	60	1 to 10,000
History	Keep resolved alarms (days)	365	0 (forever) to 36,500

Changes are audited and apply within about a minute. The page needs the right to read organisation settings; saving needs the right to change them.

Flow alarms

Alarms raised by a flow’s Raise alarm block use the block’s own settings: notify_to (user ids, e-mail addresses, OWNER / ADMIN / USER), notify_channels, notify_min_severity and notify_repeat_sec. They pass the same gates. Alarms raised by a Rules-card action have no notify block; use a Tell people action next to it. See Notifications from rules and flows.

Recipes

Need	Block
Admins for Major and up, reminders every 30 minutes	{ "recipients": [ { "kind": "role", "role": "ADMIN" } ], "minSeverity": "MAJOR", "repeatEverySec": 1800 }
A shared mailbox for everything	{ "recipients": [ { "kind": "email", "email": "alarms@example.com" } ] }
Owners in the bell only	{ "recipients": [ { "kind": "role", "role": "OWNER" } ], "channels": ["inapp"] }
Critical only, to the whole team	{ "recipients": [ { "kind": "role", "role": "USER" }, { "kind": "role", "role": "ADMIN" } ], "minSeverity": "CRITICAL" }