This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of theService Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see thelaunch stage descriptions.

Anincident is a record of when the condition of an alerting policy ismet. Typically, Cloud Monitoring opens an incident and sends anotification when the condition of the alerting policy is met. However,incidents aren't created under the following circumstances:

• The policy is snoozed or disabled.
• The number of alerting policies or incidents exceeds existinglimits for alerting.

For each incident, Monitoring creates anIncident details page that lets you manage the incident, andthat reports incident information that can help you troubleshoot thefailure.For example, theIncident details page shows lists of SQL queryresult summaries and related incidents.

This document describes how you can find your incidents. It also describeshow you can use theIncident details page to manageincidents for SQL-based alerting policies,which evaluate the results of a SQL query run against data fromgroups of log entries.

This feature is supported only for Google Cloud projects.ForApp Hubconfigurations, select the App Hub host project or management project.

Before you begin

To get the permissions that you need to view and manage incidents, ask your administrator to grant you the following IAM roles on your project:

• View incidents by using the Google Cloud CLI or the Cloud Monitoring API:Monitoring Alert Viewer (roles/monitoring.alertViewer)
• View incidents by using the Google Cloud console:
  • Monitoring Cloud Console Incident Viewer (roles/monitoring.cloudConsoleIncidentViewer)
  • Stackdriver Accounts Viewer (roles/stackdriver.accounts.viewer)
• Manage incidents by using the Google Cloud console:
  • Monitoring Cloud Console Incident Editor (roles/monitoring.cloudConsoleIncidentEditor)
  • Stackdriver Accounts Viewer (roles/stackdriver.accounts.viewer)

For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

For more information about Cloud Monitoring roles,seeControl access with Identity and Access Management.

View incidents

To view incidents in your project, use the Google Cloud console,the gcloud CLI (Public Preview), or the Monitoring API(Public Preview).

gcloudalphamonitoringalertsdescribeALERT_NAME

gcloudalphamonitoringalertsdescribeALERT_NAME

gcloudalphamonitoringalertsdescribeALERT_NAME

{  "name": "projects/my-project/alerts/my-alert-id",  "state": "OPEN",  "open_time": "2025-06-11T09:53:46Z",  "resource": {    "type": "sql_alert"  },  "policy": {    "name": "projects/my-project/alertPolicies/POLICY_1",    "displayName": "test-policy"  },  "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."}

gcloudalphamonitoringalertslist

gcloudalphamonitoringalertslist

gcloudalphamonitoringalertslist

{  "alerts": [    {      "name": "projects/my-project/alerts/my-alert-id",      "state": "OPEN",      "open_time": "2025-06-11T09:53:46Z",      "resource": {        "type": "sql_alert"      },      "policy": {        "name": "projects/my-project/alertPolicies/POLICY_1",        "displayName": "test-policy"      },      "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."    }  ]}

GET https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts/ALERT_ID

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "x-goog-user-project:PROJECT_ID" \
     "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts/ALERT_ID"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "x-goog-user-project" = "PROJECT_ID" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts/ALERT_ID" | Select-Object -Expand Content

{  "name": "projects/my-project/alerts/my-alert-id",  "state": "OPEN",  "open_time": "2025-06-11T09:53:46Z",  "resource": {    "type": "sql_alert"  },  "policy": {    "name": "projects/my-project/alertPolicies/POLICY_1",    "displayName": "test-policy"  },  "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."}

GET https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "x-goog-user-project:PROJECT_ID" \
     "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "x-goog-user-project" = "PROJECT_ID" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts" | Select-Object -Expand Content

{  "alerts": [    {      "name": "projects/my-project/alerts/my-alert-id",      "state": "OPEN",      "open_time": "2025-06-11T09:53:46Z",      "resource": {        "type": "sql_alert"      },      "policy": {        "name": "projects/my-project/alertPolicies/POLICY_1",        "displayName": "test-policy"      },      "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."    }  ]}

--data-urlencode "filter=(open_time>=\"`date -u -d "1 hour ago" +"%Y-%m-%dT%H:%M:%SZ"`\")"

--data-urlencode "filter=(open_time>=\"`date -u -d "1 DAY ago" +"%Y-%m-%dT%H:%M:%SZ"`\" AND state=open)"

--data-urlencode "filter=(open_time>=\"`date -u -d "2 DAY ago" +"%Y-%m-%dT%H:%M:%SZ"`\" AND open_time<=\"`date -u -d "1 DAY ago" +"%Y-%m-%dT%H:%M:%SZ"`\")"

--data-urlencode "filter=(policy.user_labels.app=\"my-gke-app\")"

$baseUrl = "https://monitoring.googleapis.com/v3/projects/my-project/alerts"$filterValue = (Get-Date).AddHours(-1).ToString("yyyy-MM-ddTHH:mm:ssZ")$filter = 'open_time >= "' + $filterValue + '"'$encodedFilter = [System.Uri]::EscapeDataString($filter)$url = $baseUrl + "?filter=" + $encodedFilter

Investigate an incident

TheIncident details page contains information that may help youidentify the cause of an incident.

Explore query results

TheTotal slot time consumed per day pane shows the amount of timethat your reserved BigQuery slots spent runningthe SQL queries for the alerting policy over the last 24 hours.

TheSQL query results pane shows a list of query result summaries fromeach time Log Analytics ran the SQL query from the alerting policy's condition.By default, the list is filtered to show only queries that matched thecondition of the alerting policy.

• To view the query and the table of query results from a specific time thatLog Analytics ran the query, click a value from theQuery run timecolumn.
• To toggle between showing only query results that matched the condition of thealerting policy and all queries that Log Analytics ran from the alerting policy,clickShow only queries matching alert conditions.

View supplementary information

TheDocumentation section shows the documentation template fornotifications that you provided when creating the alerting policy.This information might include a description of what the alertingpolicy monitors as well as tips for mitigation. For more information, seeAnnotate notifications with user-defined documentation.

If you didn't configure documentation for your alerting policy,then theDocumentation pane shows "No documentation is configured."

Explore related incidents

To help you discover underlying issues across your application, you canexplore incidents related to other alerting policy conditions.

Manage incidents

Incidents are in one of the following states:

• error Open: The condition of the SQL-based alerting policy was met, and theincident is still open. If the same condition is met again andthere is already an incident open, then a new incident isn'topened.

• warning Acknowledged:The incident is open and has manually been marked as acknowledged.Typically, this status indicates that the incident is beinginvestigated.

• check_circle Closed: You have manually closed the incident, or it was automatically closedafter the auto-close period expired.

Acknowledge incidents

We recommend that you mark an incident as acknowledged when you begininvestigating the cause of the incident.

To mark an incident as acknowledged, do the following:

1. In theIncidents table of theAlerting page,clickSee all incidents.

2. On theIncidents page, find the incident that you want toacknowledge, and then do one of the following:

   • Clickmore_vert More options and then selectAcknowledge.
   • Open the details page for the incident and then clickAcknowledge incident.

Snooze an alerting policy

To prevent Monitoring from creating incidents and sendingnotifications during a specific time period, snooze the related alerting policy. When you snooze an alerting policy, incidents related to the alertingpolicy remain open but don't cause further notifications. The incidentsclose based on the alerting policy auto-close duration.

To create a snooze for an incident that you are viewing, do the following:

1. On theIncident details page, clickSnooze Policy.

2. Select the snooze duration. After you select the snooze duration, the snoozebegins immediately.

You can also snooze an alerting policy from theIncidents page byfinding the incident that you want to snooze, clickingmore_vert More options, and then selectingSnooze.You can snooze alerting policies during outages to prevent furthernotifications during the troubleshooting process.

Close incidents

You can let Monitoring close an incident for you, oryou can close the incident.

Monitoring automatically closes an incident when theauto-close duration for the alerting policy expires. By default, the auto-closeduration is 7 days. The minimum auto-close durationis 30 minutes.

The auto-close duration specifies the time that must elapse, without a repeatof the cause of the incident, before the incident closes. For thisreason, when an incident is open and its cause reoccurs, theincident can stay open longer than the auto-close duration.

To close an incident, do the following:

1. In theIncidents table of theAlerting page, clickSee all incidents.

2. On theIncidents page, find the incident that you want toclose, and then do one of the following:

   • Clickmore_vert View more and then selectClose incident
   • Open theIncident details page for that incidentand then clickClose incident.

If you see the messageUnable to close incident, try again in a fewminutes. You can't close a new incident immediately because the conditionsthat caused the incident are still considered active by the alertingsystem.

Data retention and limits

For information about limits and about the retention period of incidents,seeLimits for alerting.

What's next

• To create and manage alerting policies with the Monitoring API orfrom the command line, seeManage alerting policies by API.