Alerting Trends

This article covers the Alerting Trends page of the Kentik portal.

The Alerting Trends page provides an interactive, macro-level view of how alert volumes and severities fluctuate over time across your network infrastructure. This helps operators spot patterns, investigate recurring anomalies, and prioritize troubleshooting efforts.

The page is split into two primary tabs:

• Overview Tab: Displays historical trend graphs, geographic distribution, and site-by-site breakdowns.

• Activity Tab: Provides a chronological ledger of individual alert events and status changes.

Note: For a live dashboard of currently ongoing alarms and individual event logs, see the Alerting Page article or learn how to resolve active issues in Manage Alerts.

Page Controls & Filters

The left-hand Filters pane and top-right Actions controls allow you to dynamically scope the data reflected in the visualizations in both the Overview Tab and Activity Tab:

• Actions: A dropdown menu located at the top right providing reporting utilities:

  • Export: Generates a downloadable PDF report of the current visual dashboard.

  • Subscribe: Opens a configuration dialog to schedule automated email reports.

• Time Range (UTC): A dropdown menu to select the historical window for evaluation (e.g., Last 90 days).

• Type: Checkboxes to toggle data inclusion from specific alert source categories:

  • NMS: Device, interface, and system-level monitoring events driven by your NMS Policy Settings.

  • Traffic: NetFlow and VPC flow-log based volume and threshold violations managed via Flow Policy Settings.

  • Protect: Network security anomalies and mitigation events associated with DDoS Defense.

Overview Tab

The Overview tab serves as the primary dashboard for analyzing macro-level alert activity across your network. By leveraging interactive charts and a geographic map, this tab allows you to quickly visualize alert volume trends, assess severity distributions over time, and pinpoint the specific network sites experiencing the highest frequency of issues.

Alerts: Severity Over Time

This area chart visualizes the total volume of generated alerts plotted across your selected time window. Data series are automatically color-coded by their active severity tier:

• Critical | Severe | Major | Warning | Minor

• Interaction: Hovering over any point along the timeline isolates the data series, displaying the exact count and percentage breakdown for that specific interval.

Alerts: Volume by Site

This section maps and tabulates alert frequency across geographic locations to pinpoint highly affected areas:

• Map: Displays interactive site location pins. A green pin denotes a healthy site with zero alerts during the window, while colored pins highlight the highest active severity tier present at that location. Use the +/- buttons to zoom.

• Table: Lists network sites in a grid alongside granular columns for each severity tier. Click any Site hyperlink to navigate to the Alerting page for that particular site.

  

Activity Tab

The Activity tab shifts the focus from macro-level geographic and severity trends to specific operational hotspots. It highlights the exact policies and devices generating the most noise within your selected timeframe, helping you prioritize tuning and troubleshooting efforts.

The tab is divided into two primary ranked tables:

Most Triggered Policy Activity

This section displays a ranked list of the configured Alert Policies that have fired most frequently based on your active filters. The table includes:

• Type: The functional category of the policy (e.g., NMS, Traffic, Protect).

• Policy Name: The specific name of the alert policy. Click a policy name to open the Alerting page, filtered for that policy.

• Triggered Policy Alert Volume: A sparkline graph visualizing the frequency of the policy's alerts over the selected time range.

• Relative Alert Severity Volume: A color-coded, proportional bar chart showing the breakdown of severity levels for these alerts (e.g., Critical, Major, Minor).

• Total Activity: The total aggregate count of alerts generated by the policy.

• View All: A link at the bottom of the table to expand the list and view all triggered policies beyond the top 10.

TIP: If a policy exhibits an unexpectedly high volume of minor or warning states here, consider adjusting its thresholds in Alert Policies.

Most Activity By Device

This section identifies the specific network elements that are the source of the highest alert volumes. The table includes:

• Device Name: The recognized name of the device generating the alerts, which is hyperlinked for quick pivoting to device-specific views.

• Device Alert Volume: A sparkline graph showing the temporal trend of alerts for this specific device.

• Relative Alert Severity Volume: A color-coded, proportional bar chart indicating the severity makeup of the device's alerts.

• Total Activity: The total aggregate count of alerts associated with the device.

• View All: A link at the bottom of the table to expand the list and view all devices with recorded activity.