Alert Trend

What this report shows

The volume of operational alerts dispatched over time, broken down per day by severity (info / warn / error / critical).

Data source: `alert_events` — the audit log every `dispatchAlert()` call writes a row to, regardless of whether any routing rule was configured to deliver it. That means this report shows everything the system tried to alert about, not just what was routed to a channel.

How to read it

• Daily count — total alerts dispatched that day.
• Severity stack — info (lowest) at the bottom, critical at the top.
• Spikes at critical severity are the ones that matter — they indicate something fired off the well-known alert taxonomy at a level worth investigating.

Common questions

• Why are most alerts info-severity? Many integrations dispatch info alerts as routine breadcrumbs (a backfill finished, a webhook arrived). They're part of the audit trail, not necessarily actionable.
• Why isn't a known incident showing as critical? Either it was dispatched at a lower severity, or it never went through `dispatchAlert()` — some failure paths log to other places (logs / Sentry) instead.
• Why is "today" lower than other days? Today is in-progress — wait until the day closes.

What to do if numbers look wrong

1. Click into a noisy day to see the per-event detail in the Recent Events tab of the Alert Routing page.
2. If you're missing alerts you expected, search the audit log for the relevant category — they may have logged but not dispatched.
3. Critical-severity spikes warrant cross-checking the cron-MTTR report and the audit-anomalies report.