Alerts & notifications
View and manage active alerts in the Incidents page. Understand how threshold rules, duration windows, and alert states work in Watchflare.
Watchflare sends a notification when a metric exceeds a threshold or when a host goes offline. Alerts are evaluated every 30 seconds. Global defaults apply to all hosts, and individual hosts can override any rule from their Alerts tab.
For the full list of alert types and configuration options, see the Hub alert reference.
Note
Email delivery requires SMTP to be configured. Go to Settings → Notifications. See Email notifications.
Alert types
| Alert | Triggers when | Unit |
|---|---|---|
| Host offline | No heartbeat for more than 15 seconds | None |
| CPU usage | CPU % exceeds the threshold | % |
| Memory usage | Memory % exceeds the threshold | % |
| Disk usage | Disk % exceeds the threshold | % |
| Load average (1 min) | 1-min load average exceeds the threshold | None |
| Load average (5 min) | 5-min load average exceeds the threshold | None |
| Load average (15 min) | 15-min load average exceeds the threshold | None |
| Temperature | CPU temperature exceeds the threshold | °C |
Configuring alerts
Global defaults
Go to Settings → Alerts to set default thresholds that apply to all hosts. These are a good starting point, and you can override them per host where needed.
Per-host rules
- Open a host’s detail page.
- Click the Alerts tab.
- Toggle the alert types you want and set the threshold for each.
- Changes are saved immediately.
Per-host rules take priority over global defaults.
Duration window
Each rule has a duration (default: 5 minutes). The metric must exceed the threshold continuously for the full duration before an incident opens and a notification is sent. Brief spikes shorter than the duration are ignored.
Incidents
When a threshold is breached for the configured duration, the Hub opens an incident:
- A notification is sent when the incident opens.
- A second notification is sent when the incident resolves (metric returns below the threshold, or the host comes back online).
Incidents are visible in the Alerts tab and the Incidents section on each host’s detail page, with the start time, resolution time, and the value that triggered the breach.
Incidents have three states: active (the breach is ongoing), paused (the host was paused while the incident was open), and resolved. Pausing a host suspends its open incidents instead of resolving them: they are excluded from the active list and marked with a paused badge. Resuming the host restores them to active handling without a false resolution. See Pausing a host.
The /incidents page in the sidebar shows incidents across every host in a single view, filterable by state.
Host offline alerts
The host offline alert fires when the Hub’s stale checker detects no heartbeat for more than 15 seconds. The agent sends a heartbeat every 5 seconds, so approximately 3 missed heartbeats trigger the transition to offline.
The incident resolves automatically on the next successful heartbeat.
Tip
Pause a host before planned maintenance to suppress offline alerts. See Pausing a host.
Temperature alerts
Temperature collection only runs on physical hosts. It is skipped on VMs and Docker containers, so enabling a temperature alert on a VM will never fire.
Notification delivery
Notifications are delivered to one or more notification channels (Discord, Slack, Telegram, Matrix, Ntfy, Gotify, SMTP, generic HTTP, and more via Shoutrrr). Channels are configured in Settings > Notifications.
Each notification includes:
- The host name and alert type
- The value that triggered the breach and the configured threshold
- The time the incident opened or resolved
Email requires SMTP to be configured. Use the Send test email button to verify your setup before relying on alerts. See Email notifications.
Notification channels deliver the same alerts to any of the Shoutrrr destinations listed above. See Notification channels.