Legacy alert errors and solutions
The following table contains errors and resolutions for legacy alerts.
Table: Legacy alert errors and solutions
Message | Version | Severity | Description | Solution |
---|---|---|---|---|
Alert is broken and will not run | Error | The alert configuration prevents the alert running. | Edit the alert and save it again. For more information about how to do this, see Editing Alerts. | |
Polling alert query resulted in an error | Error | The alert query produced an error. This can be due to many different reasons. |
Look at the message in the exceptionMessage and
consult documentation based upon that for possible solutions.
| |
Could not submit alert query | Error | There can be several reasons that it is not possible to submit the query. |
Look at the exceptionMessage and consult
documentation based upon that for possible solutions. Contact
LogScale Support for
assistance if needed.
| |
Alert is being stopped, since the alert is not assigned to run on any node | Error | The alert is not assigned to run on any nodes. Alerts are distributed evenly among the nodes in a cluster, so that each one runs on a single node. Reassignment of nodes on which alerts run occurs automatically when new cluster nodes are added or old cluster nodes are removed. | If the alert does not run on another node after 15 minutes, contact LogScale Support. | |
Could not submit alert query since it is blocked | Error | The alert query cannot run since it is blocked. | Either rewrite the alert query so it is no longer blocked, or check with the system administrator and remove the query from the blocklist. If using LogScale Cloud, this error can occur if the cluster is in a maintenance window. | |
Could not submit alert query since the search interval is too short | Error | Could not submit the alert query since the search interval is too short. | Edit the query to expand the search interval and save it. For more information about how to do this, see Editing Alerts. | |
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the alert to run as a different user or on behalf of the organization. | Error | The user attempting to execute the query no longer exists in the system. | Save the alert as a user that exists in the system, or change the alert to run on behalf of the organization. For more information about how to do this, see Editing Alerts. | |
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | Error | The user attempting to execute the query no longer exists in the system. | Save the alert as a user that exists in the system, or change the alert to run on behalf of the organization. For more information about how to do this, see Editing Alerts. |
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the alert to run as a different user or on behalf of the organization. | Error | The configured user no longer has read access to the view or repository. | Grant the user read permissions on the repository or view that the alert is running in, change the alert to run as another user with such permissions, or change the alert to run on behalf of the organization | |
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | Error | The configured user no longer has read access to the view or repository. | Grant the user read permissions on the repository or view that the alert is running in, change the alert to run as another user with such permissions, or change the alert to run on behalf of the organization |
Alert has changed, restarting query | Info | The alert query was edited while running, so the query will restart automatically. | None. This message is informational. | |
Alert found results, but no actions were invoked since the alert is throttled | Info | The alert found results, but no actions were invoked since the alert is throttled. | None. This message is informational. | |
Alert triggered and invoked at least one action and will be throttled | Info | The alert triggered and invoked at least one action. The alert will be throttled. | None. This message is informational. | |
Alert triggering | Info | The alert is triggering actions. | None. This message is informational. | |
Alert is being stopped, since the alert is assigned to run on node $vhost | Info | The alert was assigned to run on a another node in the cluster. | None. This message is informational. | |
Alert is being stopped, since the alert was deleted | Info | The alert was deleted and will not run. | It is not possible to recover a deleted alert. If you want it to run, you must create the alert again. | |
Alert has been disabled and the alert query will be cancelled | Info | The alert was disabled and cannot run. | If you want the alert to run, enable it again. For more information about how to do this, see Editing Alerts. | |
Alert is running on a view that is not connected to any repository. The alert query will be cancelled | Info | The alert contains a view that is not connected to any repository. | Edit the view to connect it to a repository, or edit the alert to use another view that is connected to a repository. | |
License has expired and the alert query will be cancelled | Info | The license has expired and must be renewed to continue. | Contact LogScale Support for assistance. | |
Alert no longer has any associated actions and the alert query will be cancelled | Info | The alert has no associated actions. Because a successful alert must trigger at least one action, the alert is stopped. | Edit the alert to add actions and save it. For more information about how to do this, see Editing Alerts. | |
Alert found no results and will not trigger | Info | The alert query, as configured, found no events that matched its requirements and no actions will trigger. | None. This message is informational. | |
Alert is being stopped, since the organization is being transferred | Info | The organization is being transferred to a new cluster, and alerts are stopped during the transfer process. | If not resolved after 15 minutes, contact Logscale Support for more information. | |
Alert is being stopped, since the organization of the alert was deleted | Info | The organization for which the alert was created has been deleted. | Recreate the alert for another organization. | |
Alert encountered a cancelled query | Info | The alert encountered a cancelled query during execution. | None. This message is informational. The alert query will be restarted automatically. If this happens frequently, review the alert configuration and contact LogScale Support, if needed. | |
Query started | Info | The query started successfully. | None. This message is informational. | |
Alert is being stopped, since the view of the alert was deleted | Info | The view with which the alert was associated has been deleted and the job cannot run. | Add the alert to another view. | |
Polling alert query resulted in warnings that are normally treated as errors. The alert will still trigger if the result contains events | Info | Polling the alert query resulted in warnings that are normally treated as errors. The alert will still trigger actions if the result contains events. | This message is informational and does not require action. However, consider whether the specific messages in the errors field should be fixed. | |
Problem invoking action. If all actions fail, they will be retried | 1.144.0 | Warning | There was a problem invoking the alert's actions. In order to be successful, at least one action must trigger on an alert. The alert is not considered to have triggered and will not be throttled. | Check the logs for the invoked actions if unsure which action failed. Check if there are any problems with the action targets, such as e-mail server down, pager service down, and so on. |
Problem invoking action | Warning | There was a problem invoking the alert's actions. In order to be successful, at least one action must trigger on an alert. The alert is not considered to have triggered and will not be throttled. | Check the logs for the invoked actions if unsure which action failed. Check if there are any problems with the action targets, such as e-mail server down, pager service down, and so on. | |
Problem invoking actions. The alert is not considered to have triggered and will not be throttled | Warning | There was a problem invoking the alert's actions and all actions failed. In order to be successful, at least one action must trigger on an alert. The alert is not considered to have triggered and will not be throttled. | Check the logs for the invoked actions if unsure which action failed. Check if there are any problems with the action targets, such as e-mail server down, pager service down, and so on. | |
Polling the alert in the previous alerts loop has not finished. The alert will not be polled in this loop | Warning | The alert did not finish in the previous run, so it cannot be polled in the current run. | None. This message is informational. If the problem continues, you can disable the alert, wait one minute, and enable the alert. NOTE: If you do this you may lose results. | |
Starting the query for the alert in the previous alerts loop has not finished. The alert will not be polled in this loop | Warning | The alert query starting did not finish in the previous run, so it cannot be polled in the current run. | None. This message is informational. If the problem continues, you can disable the alert, wait one minute, and enable the alert. NOTE: If you do this you may lose results. | |
Some of the actions invoked by the alert in the previous alerts loop have not finished and none have finished successfully. The alert will not be polled in this loop | Warning | To be successful, an alert must have at least one successful action. This error indicates that some of the actions in the alert have not finished and none have finished successfully. Therefore, the alert has no successful actions. | This warning can self-resolve. If the issue persists, contact the system administrator or LogScale Support. | |
Could not cancel alert query | Warning | The alert query could not be stopped. Query should not run. | None. This message is informational. | |
Unknown action | Warning | The alert contains an unknown action. | Edit the alert, remove the action, and add a different action. | |
Starting the query for the alert has not finished. The alert will not be polled in this loop | Warning | Starting the query for the alert has not finished. The alert will not be polled in this loop | Look at other logs from the alert to see if there are any errors or warnings, or check whether there are other problems with LogScale. | |
The query result is currently incomplete. The alert will not be polled in this loop | 1.160.0 | Warning | Starting the query for the alert has not finished. The alert will not be polled in this loop | Look at other logs from the alert to see if there are any errors or warnings, or check whether there are other problems with LogScale. |
Polling alert query resulted in warnings that are treated as errors. The alert will not trigger if the result contains events | Warning | Polling alert query resulted in warnings that are treated as errors. The alert will not trigger if the result contains events. | In this case, you must look at the specific messages in the errors field and fix them, if possible. |