Silence Alert Notifications

Sysdig Monitor allows you to silence alerts for a given scope for a predefined amount of time. When silenced, alerts will still be triggered but will not send any notifications. You can schedule silencing in advance. This helps administrators to temporarily mute notifications during planned downtime or maintenance and send downtime notifications to selected channels.

With an active silence, the only notifications you will receive are those indicating the start time and the end time of the silence. All other notifications for events from that scope will be silenced. When a silence is active, creating an alert triggers the alert but no notification will be sent. Additionally, a triggering event will be generated stating that the alert is silenced.

See Alert Silence Rules APIs for programmatically silencing alert notifications.Alert Silence Rules APIs

Configure a Silence

When you create a new silence, it is by default enabled and scheduled. When the start time arrives for a scheduled silence, it becomes active and the list shows the time remaining. When the end time arrives, the silence becomes completed and cannot be enabled again.

To configure a silence:

  1. Click Alerts on the left navigation on the Monitor UI.

  2. Click the Silence tab.

    The page shows the list of all the existing silences.

  3. Click Set a Silence.

    The Silence for Scope window is displayed.

    silenceAlert-for-scope.png
  4. Specify the following:

    • Scope: Specify the entity you want to apply the scope as. For example, a particular workload or namespace, from environments that may include thousands of entities.

    • Begins: Specify one of the following: Today, Tomorrow, Pick Another Day. Select the time from the drop-down.

    • Duration: Specify how long notifications should be suppressed.

    • Name: Specify a name to identify the silence.

    • Notify: Select a channel you want to notify about the silence.

  5. Click Save.

Silence Alert Notifications from Event Feed

You can also create and edit silences and view silenced alert events on the Events feeds across the Monitor UI. When you create a silence, the alert will still be triggered and posted on the Events feed and in the graph overlays but will indicate that the alert has been silenced.

Note

If you have an alert with no notification channel configured, events generated from that alert won’t be marked as silenced. They won’t be visually represented in the events feed as well with the crossed bell icon and the option to silence events.

To do so,

  1. On the event feed, select the alert event that you want to silence.

  2. On the event details slider, click Take Action.

    event-alert-silence.png
  3. Click Create Silence from Event.

    The Silence for Scope window is displayed.

  4. Continue configuring the silence as described in 4.

Manage Silences

Silences can be managed individually, or as a group, by using the checkboxes on the left side of the Silence UI and the customization bar. Select a group of silences and perform batch delete operations. Select individual silences to perform tasks such as enabling, disabling, duplicating, and editing.

Change States

You can enable or disable a silence by sliding the state bar next to the silences. There are two kinds of silences that will show as enabled: active (a running silence) and a scheduled silence (which will start in the future). Its starting date is back in time but the end date is yet to happen. A clock icon visually represents an active silence.

silence-alert-state.png

Completed silences cannot be re-enabled once a silenced period is finished. However, you can duplicate it with all the data but you need to set a new silencing period.

A silence can be disabled only when:

  • The silence is not yet started

  • The silence is in progress.

Filter Silences

Use the search bar to filter silences. You can either perform a simple auto-complete text search or use the categories. The feed can be filtered by the following categories: Active, Scheduled, Completed.

For example, the following shows the completed silences that start with "ag".

filter-silence-alert.png

Duplicate a Silence

Do one of the following to duplicate a silence:

  • Click the Duplicate hover-the-row button on the menu.

    duplicate-silence-rule.png
  • Click the row for the Silence for Scope window to open. On the window, make necessary changes if required and click Duplicate.

Edit Silence

You can edit scheduled silences. For the active ones, you can only extend the time. You cannot edit completed silences.

To edit a silence, do one of the following:

  • Click the row for the Silence for Scope window to open. Make necessary changes and click Update.

  • Click the Edit hover-the-row button on the menu. The Silence for Scope window will be displayed.

    edit-silence-rule.png

    Make necessary changes and click Update.

Extend the Time Duration

For the active silences, you can extend the duration to one of the following:

  • 1 Hour

  • 2 Hours,

  • 6 Hours,

  • 12 Hours

  • 24 Hours

To do so, click the extend the time duration button on the menu and choose the duration. You can extend the time of an active silence even from the Silence for Scope window.

extend-silencing.png

Extending the time duration will notify the configured notification channels that the downtime is extended. You can also extend the time from a Slack notification of a silence by clicking the given link. It opens the Silence for Scope window of the running silence where you can make necessary adjustments.

You cannot extend the duration of completed silences.