--- title: How alerting works summary: null url: >- https://www.fastly.com/documentation/guides/observability/alerts/how-alerting-works --- To get alerts working, you'll need to create [alert definitions](https://www.fastly.com/documentation/guides/observability/alerts/managing-alert-definitions) and configure [alert integrations](https://www.fastly.com/documentation/guides/observability/alerts/managing-alert-integrations) to deliver notifications. Observability metrics alerts and audit log alerts have distinct lifecycles, and this guide walks through how each type works. ## Observability metrics alerts An observability metrics alert tracks performance on one of your services or across all of them, comparing the result against a threshold or percentage change you've set. ### How observability alerts are evaluated The Alerts feature evaluates each observability metric by comparing the observed metric against the configured threshold or percentage change conditions at one-minute polling intervals over the evaluation or comparison period. For worked examples of each evaluation type, check out our [Example observability metrics alerts](https://www.fastly.com/documentation/guides/observability/alerts/example-observability-metrics-alerts) guide. ### When an observability alert fires An observability alert is triggered, or _firing_, when its configured conditions are met. Several things happen at that point: - A message is sent to each [integration](https://www.fastly.com/documentation/guides/observability/alerts/managing-alert-integrations) configured on the alert definition. The format of each message depends on the integration type. - The alert appears in the [notifications center](https://www.fastly.com/documentation/guides/account-info/user-and-account-management/monitoring-account-notifications). - The Alert bell Alert bell icon in the Fastly control panel indicates that there are active alerts. - The alert appears in the Firing alerts section of the [Alerts Overview](https://manage.fastly.com/observability/alerts) page. You can investigate a firing observability alert in two ways. For quick action, use the notifications center, which links directly to the alert. For detailed investigation, start from the Alerts Overview page and click the alert to open a dedicated details page where you can see metric history, view all instances of the alert firing or resolving, and edit the alert definition. ### When an observability alert resolves There's no manual resolve action. An observability alert resolves automatically when the system's next evaluation finds the configured threshold or percentage change conditions are no longer met. The change can be the result of customer action (for example, fixing the underlying problem that's generating 5XX errors) or the metric simply returning to expected ranges. When the alert resolves, it moves from the Firing alerts section to the Resolved alerts section of the Alerts Overview page, and a resolution message is sent to each configured integration. ## Audit log alerts An audit log alert tracks activity on your account, services, or workspaces, sending a notification when an event matches the activity type, event type, and scope you've set. ### How audit log events trigger alerts When an audit log event occurs, the Alerts feature checks whether the event matches the activity type, event type, and scope of any audit log alert definition. When a match is found, a notification is sent. ### How audit log alert notifications are sent A notification is sent to each [integration](https://www.fastly.com/documentation/guides/observability/alerts/managing-alert-integrations) configured on the matching alert definition. Unlike observability metrics alerts, audit log alerts have no persistent state. They don't appear on the Alerts Overview page, the Alert bell, or the notifications center. The integration notification is the only signal that the alert fired, and there's one notification per matching event. The notification contains a summary of the event. Every audit log event is recorded in the [Audit log](https://manage.fastly.com/account/audit-log), where you can find the one that triggered the notification and expand it for additional information.