Avoiding Alert Fatigue with Cooldowns and Flapping Detection

Prevent notification overload with smart alert management.

The Problem

Too many alerts = all alerts get ignored. Alert fatigue is the #1 reason monitoring fails.

Cooldown Periods

Set a cooldown on each alert to prevent repeated firing:

• Example: 30-minute cooldown means the alert fires once, then stays silent for 30 minutes even if the condition persists
• Useful for ongoing issues where the first notification is enough

Flapping Detection

If an alert fires, recovers, fires, recovers repeatedly in a short period, Lognitor automatically:

1. Detects the flapping pattern
2. Snoozes the alert temporarily
3. Sends a single "flapping" notification instead of dozens of fire/recover pairs

Best Practices

1. Start with fewer, broader alerts — one "any error spike" alert is better than 20 per-endpoint alerts
2. Use error rate, not absolute count — for high-traffic services, absolute error counts produce false positives
3. Set realistic thresholds — preview against historical data before activating
4. Review alerts monthly — remove or tune alerts that fire frequently but don't require action
5. Use the AI suggestion feature — let AI analyze your patterns and recommend appropriate alert rules