Alert lab

Watch an alert fire — before you page anyone

Pick a failure pattern — or bring your own: the playground's Test an alert → button carries whatever scenario you're editing straight here. Set a threshold and a for: duration, and press play. The signal comes from the real Sonda engine (the same WebAssembly build as the playground); the lane below the chart shows the alert state the way Prometheus would walk it: inactive → pending → firing → resolved.

Scenario Alert when value > value < for: 0s 6s 12s 20s 30s Play Copy sonda test setup inactive

Edit this scenario in the playground →

What the lane is showing

The evaluator walks the sampled series exactly the way a Prometheus alert rule would walk scrape samples:

• inactive — the condition is false.
• pending — the condition is true, but hasn't held for the full for: duration yet. If the signal recovers first, no alert ever fires. This is what makes for: the standard defense against flapping.
• firing — the condition has held continuously for for:. This is when Alertmanager would notify you.
• resolved — the condition went false while firing (marked with a tick on the lane).

Try the Link blips, then a real outage preset both ways: with for: 6s the two short blips never page, and the real outage still fires. Set for: 0s and every blip becomes a page — that's the on-call experience for: exists to prevent.

Run it for real

The lab simulates rule evaluation; the real thing is one button away. Copy sonda test setup exports the rule you just tuned as a ready-to-run package: the scenario YAML with a label-scoped expect: block appended (firing_within derived from when the rule actually fired in the preview), headed by the matching vmalert/Prometheus alert rule. Save it, add the rule to your rules file, and sonda test turns what you watched here into an exit code. Alert testing walks the same patterns against a live Prometheus + Alertmanager stack (the repository ships a Compose stack with vmalert wired up), and CI validation covers the pipeline side.