Alerts & Notifications
View and manage active alerts in the Incidents page. Understand how threshold rules, duration windows, and alert states work in Watchflare.
Watchflare sends email notifications when a metric exceeds a threshold or when a host goes offline. Alerts are evaluated every 30 seconds. Global defaults apply to all hosts — individual hosts can override any rule from their Alerts tab.
For the full list of alert types and configuration options, see Alerts — Hub reference.
Note
Email delivery requires SMTP to be configured. Go to Settings → Notifications. See Email notifications.
Alert types
| Alert | Triggers when | Unit |
|---|---|---|
| Host offline | No heartbeat for more than 15 seconds | — |
| CPU usage | CPU % exceeds the threshold | % |
| Memory usage | Memory % exceeds the threshold | % |
| Disk usage | Disk % exceeds the threshold | % |
| Load average (1 min) | 1-min load average exceeds the threshold | — |
| Load average (5 min) | 5-min load average exceeds the threshold | — |
| Load average (15 min) | 15-min load average exceeds the threshold | — |
| Temperature | CPU temperature exceeds the threshold | °C |
Configuring alerts
Global defaults
Go to Settings → Alerts to set default thresholds that apply to all hosts. These are a good starting point — you can override them per host where needed.
Per-host rules
- Open a host’s detail page.
- Click the Alerts tab.
- Toggle the alert types you want and set the threshold for each.
- Changes are saved immediately.
Per-host rules take priority over global defaults.
Duration window
Each rule has a duration (default: 5 minutes). The metric must exceed the threshold continuously for the full duration before an incident opens and a notification is sent. Brief spikes shorter than the duration are ignored.
Incidents
When a threshold is breached for the configured duration, the Hub opens an incident:
- An email is sent when the incident opens.
- A second email is sent when the incident resolves (metric returns below the threshold, or the host comes back online).
Incidents are visible in the Alerts tab and the Incidents section on each host’s detail page, with the start time, resolution time, and the value that triggered the breach.
The /incidents page in the sidebar shows all active and resolved incidents across every host in a single view.
Host offline alerts
The host offline alert fires when the Hub’s stale checker detects no heartbeat for more than 15 seconds. The agent sends a heartbeat every 5 seconds, so approximately 3 missed heartbeats trigger the transition to offline.
The incident resolves automatically on the next successful heartbeat.
Tip
Pause a host before planned maintenance to suppress offline alerts. See Pausing a host.
Temperature alerts
Temperature collection only runs on physical hosts — it is skipped on VMs and Docker containers. Enabling a temperature alert on a VM will never fire.
Notification delivery
Notifications are delivered to one or more notification channels (Discord, Slack, Telegram, Matrix, Ntfy, Gotify, SMTP, generic HTTP, and more via Shoutrrr). Channels are configured in Settings > Notifications.
Each notification includes:
- The host name and alert type
- The value that triggered the breach and the configured threshold
- The time the incident opened or resolved
Email requires SMTP to be configured. Use the Send test email button to verify your setup before relying on alerts. See Email notifications.
Notification channels can forward alerts to Discord, Slack, Telegram, Matrix, Ntfy, Gotify, SMTP, generic HTTP, and more via Shoutrrr. See Notification channels.