How-to
Source Silence Detector
Pages you when a Logpush source stops ingesting for more than 15 minutes — catches silent outages where the dashboard still looks fresh.
Jump to section
What it detects
When your Logpush source stops delivering batches, most of the dashboard will still look healthy for a while — charts over relative time windows keep showing recent history. You don't notice the feed is dead until someone spots that the live chart isn't actually updating.
This detector prevents that. It monitors every active source's Last Seen timestamp continuously and alerts the moment a source has been silent longer than your threshold. Deliberately, this check does not depend on the analytics data itself — the whole point is to notice when that data might be stale.
How it works
Every minute, Edge checks each active source. If the time since the last successful batch exceeds silence_minutes, the detector opens a warning alert. If the silence exceeds escalate_minutes, the severity escalates to critical.
Last Seen only advances when a Logpush batch has been fully processed end-to-end — authenticated, parsed, aggregated, archived, counted. It's a strong signal: if it's stale, something is genuinely broken.
Default thresholds
| Threshold | Default | Description |
|---|---|---|
silence_minutes | 15 | Minutes of silence before opening a warning alert |
escalate_minutes | 30 | Minutes of silence before escalating to critical |
15 minutes covers normal Logpush cadence (every 5 minutes) plus retry backoff plus a comfortable noise margin. Customers sending bursty traffic (small sites that quiet down overnight) may want to raise it to 30 / 60.
When the alert fires
- One alert per silent source — multiple sources can be silent independently
- Auto-resolves the instant the next batch lands
- Notification goes to your tenant's default routing, same as every other alert
What to do when it fires
- Check the Sources page — the freshness pill and Last Seen timestamp confirm the gap
- Check your Logpush job — look for "last pushed" and any recent errors on the job
- Common causes:
- Logpush job paused or deleted
- Bearer token rotated on the Sources page but Logpush still holds the old value (401)
- Our ingest endpoint returning errors (we'll have a fix in flight — reach out if alerts continue for more than 20 minutes)
Why it ships enabled
Ships enabled on every tenant by default. The blast radius is "you get an email when your data stream breaks" — strictly better than a silent outage. If the 15-minute threshold is too sensitive for your traffic pattern, raise it; we don't recommend disabling the detector outright.
Related
- Setting Up Your First Logpush Source — if the alert is triggered by an incomplete source setup
- Investigating an Alert — general triage procedures