# Alert Timing & Delivery Reference

> Understand exactly when your alerts fire, repeat, and resolve across notification channels. Quick reference for alert timing behavior with Threshold, Adaptive, and Anomaly alerts, and SLO violations.

Source: https://last9.io/docs/alert-timing-delivery-reference/

Get alerts when you need them. Here's exactly when notifications fire, repeat, and resolve across your channels.

:::note
**New alert rules need 5 minutes to bootstrap** before they start processing.
:::

## Quick Reference

Threshold, Adaptive, Anomaly, and log Alert Rules all share the same delivery timing:

- **First alert:** 2 minutes after the condition is met (t+2)
- **Repeat alerts:** Every 61 minutes while active
- **Resolution:** 11 minutes after the condition clears

:::note
**SLO alerts** differ: first alert at t+4, repeats every 16 minutes, resolution 31 minutes after recovery. Email is not supported as an SLO channel.
:::

## How Alert Timing Works

Once the condition is met at timestamp `t`, here's the timeline:

```
t:    Condition met (CPU spikes, error rate jumps, log match)
t+1:  Last9 confirms and generates the alert
t+2:  Notification hits your channel
t+61: Reminder if still firing
recovery+11: Resolution
```

![Alert Timing](../../../../../assets/content/docs/alerting/guides/alert-notification-behavior/alert-timeline-anomaly.jpg)

:::note
`t` is when the condition is **observed** inside Last9, not when it occurred in the real world. Data ingestion (scrape / remote-write for metrics, log-ingestion delay for logs) and the rule's evaluation or search frequency add latency before `t`. For log rules, the bad-minutes window does not apply — it is fixed at 1 out of 1.
:::

## Notification Channels

All alert types deliver to every channel — Slack, PagerDuty, OpsGenie, Webhook, and Email — with the same timing. The only exception is **SLO alerts**, which do not support Email.

## Why These Delays?

- **Processing time:** Last9 needs 1-3 minutes to ingest data, evaluate the rule, and confirm the condition
- **Delivery buffer:** 1-minute buffer accounts for network latency and channel processing
- **Resolution delays:** Prevents flapping alerts when conditions briefly recover then fail again

## Example

**Scenario:** API response time spikes at 1:59 PM

- **2:01 PM:** Last9 confirms the breach
- **2:02 PM:** Webhook fires, Slack notification arrives
- **3:01 PM:** Reminder if still alerting
- **When fixed + 11 min:** Resolution notification

## Changing the Repeat Interval

The repeat frequencies above are the defaults. You can configure a custom interval, cap the number of reminders, or switch to **notify-once** (one notification per firing episode) on a per-alert-group basis.

See [Repeat Notification Interval](/docs/repeat-notification-interval/) for configuration steps.

---

## Troubleshooting

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.