Alert Timing & Delivery Reference

Get alerts when you need them. Here’s exactly when notifications fire, repeat, and resolve across your channels.

Quick Reference

Threshold, Adaptive, Anomaly, and log Alert Rules all share the same delivery timing:

First alert: 2 minutes after the condition is met (t+2)
Repeat alerts: Every 61 minutes while active
Resolution: 11 minutes after the condition clears

How Alert Timing Works

Once the condition is met at timestamp t, here’s the timeline:

t:    Condition met (CPU spikes, error rate jumps, log match)
t+1:  Last9 confirms and generates the alert
t+2:  Notification hits your channel
t+61: Reminder if still firing
recovery+11: Resolution

Alert Timing

Notification Channels

All alert types deliver to every channel — Slack, PagerDuty, OpsGenie, Webhook, and Email — with the same timing. The only exception is SLO alerts, which do not support Email.

Why These Delays?

Processing time: Last9 needs 1-3 minutes to ingest data, evaluate the rule, and confirm the condition
Delivery buffer: 1-minute buffer accounts for network latency and channel processing
Resolution delays: Prevents flapping alerts when conditions briefly recover then fail again

Example

Scenario: API response time spikes at 1:59 PM

2:01 PM: Last9 confirms the breach
2:02 PM: Webhook fires, Slack notification arrives
3:01 PM: Reminder if still alerting
When fixed + 11 min: Resolution notification

Changing the Repeat Interval

The repeat frequencies above are the defaults. You can configure a custom interval, cap the number of reminders, or switch to notify-once (one notification per firing episode) on a per-alert-group basis.

See Repeat Notification Interval for configuration steps.

Troubleshooting

Please get in touch with us on Discord or Email if you have any questions.