Create your first alert

Before you begin

• Complete your first workload and notification test.
• Sign in to LogForge as Owner, or with permission to manage rules and view the workload.
• Keep logforge-docs-first-workload running and monitored. Confirm its logforge first workload ready messages are saved.

All rule steps happen in the browser. Sample-container commands run on its Docker host.

This exercise sends notifications. Add only a notification action. Leave restart, stop, kill, and custom-script actions out.

Create a rule for the sample

1. Open Alerts > Rules > New rule.
2. Name it First workload notification; select Warning urgency.
3. Under What should trigger?, choose Type: Keyword in logs and enter:

4. Under What should this monitor?, choose the container option in Monitor, then the exact sample container on the intended host. Do not select the whole host.
5. Under What should happen?, choose Add action. Set Action to Send notification and Your destination (optional) to Operator test channel, or your destination's name. Leave Add users or teams empty and Delivery failure behavior at Required. Confirm Add action.

Use these exact sample values. Select the single container, then add only a notification action.

Choose a destination for this exercise. The field says optional because rules can notify other users or teams instead. Leaving every recipient empty does not configure delivery.

Leave users and teams empty for this personal destination, then choose Add action.

Check: the summary describes three matching sample messages within sixty seconds and one notification action. This is an exercise threshold, not production guidance.

Check the draft against saved data

1. Choose Validate rule and resolve blockers.
2. Under Test against retained data, use your browser's local time. Set Start after monitoring was applied and before three saved sample messages; set End after those messages. Keep the interval within 24 hours. The default last hour may include time before your sample existed.
3. Choose Test retained data.
4. Read the outcome, firing episodes, and Coverage and technical reasons.

Expected: a complete test says would fire. This test sends no notification and runs no response action. Partial, unknown, or blocked results need investigation; a clear result may simply have too few matches.

Example result from sample data. Your counts and times will differ; check Coverage and technical reasons as well as the outcome.

Enable and check a new firing

1. Choose Create rule. The saved rule is pending.
2. Open the saved rule's detail. Choose the play button (Enable rule), then confirm Enable rule. Check that the rule shows Enabled.
3. Keep the sample producing new messages.
4. Open Alerts in the top navigation, then the Alerts tab. Find the new event for First workload notification and open it.
5. Check Automated response and the delivery status under Notifications. Expand Delivery details for delivery information or Technical details and audit for identifiers and diagnostics. Check the receiving channel too.

Check: the event records a new firing, delivery evidence reports success, and the message arrives. A saved-data result or alert event alone does not prove delivery. Allow for evaluation intervals and delivery retries.

Actual local test alert using email. Your rule name and provider will differ; look for Completed and Delivered, then confirm receipt in your own channel.

Enabling authorizes the configured automatic response. LogForge rechecks permissions and target health before running the response; it does not request another click each time.

Disable and clean up

1. Open the rule's detail, choose Pause, enter a reason, confirm Pause rule, and check the rule is no longer enabled.
2. Retire it when finished if offered.
3. Remove your sample if you created it for this exercise.
4. Remove the rule's destination reference before deleting a temporary destination.

Pausing stops new firing cycles, but does not cancel accepted work or erase alert history. Keep existing applications, agent identities, and saved evidence.

If the expected result is missing

Problem: no test match, firing, or delivery.

Why it matters: saved logs, rule evaluation, and delivery are separate checks.

Next step: verify the workload, saved text, monitoring, test interval, enabled revision, and displayed reasons. Use No data or notification troubleshooting. Keep rule, event, request, and audit identifiers for support.