What is the "Do (not) require a full window of data for evaluation" monitor parameter?

There are 2 main scenarios for which you'll likely need to require a full window of data for evaluation:

  1. multi-alert monitors triggering a separate alert per {group}, where new groups can appear.
  2. monitors using the alerting method "In total".

Example 1: a multi-alert CPU monitor triggering one separate alert per host, over the average of the past 10 min of data.

- If a new host is provisioned it may have high CPU for a minute or two, but you would not want alerts to trigger if the CPU will drop shortly after.
- Without a full window of data, 2 min after any host provision, the monitor looks at the past 10 min, only has 2 min of data but evaluates the alert anyway and triggers an alert.

Example 2: a monitor triggering alerts on the custom metric "error_number" in total over the past 5 min. This metric value is collected by your system every 2 min and is expected to be 2 in normal times.

- Datadog monitors are evaluated every minute, so 50% of the time, the monitor will see 2 values over the past 5 minutes (monitor value 4). The other 50% of the time, 3 values are seen (monitor value 6).
- Without requiring a full window of data, even with constant data, the monitor sees compares different values over time against the threshold you set up.

There are 2 main scenarios for which you'll need to disable the full window of data, they correspond to sparse metrics :

  1. metric not sent at a regular interval
  2. metric not often sent compared to the alerting window

Example 1: a monitor based on an error counter, only incremented if an error happens.

- With the full window of data activated, the monitor will likely not detect any full window, so it may skip all evaluations and not alert you at all.

Example 2: a monitor alerting on the past 10 min, for a metric submitted every 20 min.

- It doesn't really make sense to ask for a full window of data, and using this parameter may cause the monitor to skip all evaluations and not alert you at all.

For other scenarios, this "full window of data" doesn't have much influence on your monitor.

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.
Powered by Zendesk