Monitoring Alert Email - Incorrect Query In Button Link

[rod-mayden]

Within the monitoring dashboard I have alerting configured with specific criteria, including;

logName="projects/test1/logs/apache_error"

jsonPayload.module:"php"

jsonPayload.message!~"session save handler"

The alert is configured to email specified groups when logs match the given criteria . 

When running the query from 'Logs Explorer' I correctly see the required logs matching the given criteria.

The issue is that when an email is received because logs have matched the criteria given in the alert, the button labelled 'View Incident' links not to the query for which the criteria has matched, but a generic query detailing;

'resource.type', 'resource.labels.zone', 'resource.labels.project_id' and 'resource.labels.instance_id'

Has anyone else had this issue and have any advice on how to resolve this?

[ronnelg]

Hi @rod-mayden, 

Welcome to Google Cloud Community!

Are you getting any error message aside from the generic query? Also, can you provide the exact query or metric you are using for the alerting policy?

In the meantime, please review your alerting policy to ensure it's configured correctly. You can also check this troubleshooting page for Cloud Monitoring. I recommend also to create a new alerting policy with different query or metric to just check if it still throws a generic query.

I hope the above information is helpful.

[rod-mayden]

Hi @ronnelg,

There are no error messages when the page from the link is opened. I have listed the query below, abstracting our application name accordingly:

Conditions: Policy violates when ANY condition is met

logName="projects/applicationuk/logs/apache_error" jsonPayload.module:"php" jsonPayload.message!~"session save handler" jsonPayload.message!~"INSERT INTO sessions" jsonPayload.message!~"Failed to write session data" jsonPayload.message!~"not found or unable to stat" jsonPayload.message!~"Cannot serve directory"

 
In the meantime I will look to create another alerting policy and update once we have the results from that.

[rod-mayden]

Hi @ronnelg ,

We have created a new test alert and the query shown in the email is also linked to the generic query seen in the real alerting. I have given a copy of the query the button links to, abstracting the ID accordingly

resource.type="gce_instance" AND resource.labels.project_id="orbituk" AND resource.labels.zone="europe-west2-a" AND resource.labels.instance_id="0000000000000000001"

 What are the next steps here?

Kind Regards

Luke