What is MQL (Monitoring Query Language) and how is it used in alarms?

MQL is the query language used to define metric conditions in OCI alarms. A typical MQL query specifies the metric namespace, metric name, statistic, interval, and optional grouping dimensions. For example: CpuUtilization[5m]{availabilityDomain = "AD-1"}.mean() > 80. The alarm evaluates this query at the specified interval and enters FIRING state when the condition is true for the configured number of consecutive evaluation periods.

How do alarm severity levels and notification destinations work?

OCI alarms support four severity levels: CRITICAL, ERROR, WARNING, and INFO. The severity is informational and determines the visual indicator in the console but does not change how the alarm is evaluated. Each alarm sends notifications to an OCI Notification Service topic, which can deliver messages via email, Slack, PagerDuty, HTTPS webhooks, or OCI Functions. You can configure different notification topics for different severity levels.

Can I suppress alarm notifications during maintenance windows?

Yes, OCI supports alarm suppressions that prevent notifications during specified time windows. You define the suppression start time, end time, and an optional description. During the suppression window, the alarm continues to evaluate and change state, but notifications are not sent. This is useful for planned maintenance, deployments, or known capacity changes that would otherwise trigger false alerts.

OCI Alarm Config Builder

MonitoringOCI

Build OCI Monitoring alarm configurations with MQL queries and notification topics.

Last verified: May 2026

OCI Alarm Configuration

Display Name

Compartment OCID

Namespace

Severity

Enabled

MQL Query

Message Body

Pending Duration

Repeat Notification

Notification Destinations (Topic OCIDs)

Display name is required
At least one destination (topic OCID) is required

Generated OCI Alarm JSON

Output will appear here...

About This Tool

OCI Monitoring alarms evaluate metric conditions and trigger notifications when thresholds are breached. Configuring alarms requires specifying the target metric, statistic (mean, max, min, sum, rate, count), aggregation interval, comparison operator, threshold value, and the notification destination. Alarms support composite conditions with grouping dimensions and suppression windows for maintenance periods. This builder helps you assemble alarm definitions with correct MQL (Monitoring Query Language) queries, evaluation periods, and notification topic references, outputting configurations for Terraform, the OCI CLI, or the Monitoring API.

Real-World Scenario

Your team is rolling out a new web service across 30 instances. The naive alarm 'any CPU > 80% for 1 minute' fires 50+ times per day during normal autoscaling. The builder helps you rebuild: composite alarm with 'p95 latency > 1000ms FOR 3 OF 5 evaluation periods AND error rate > 1%'. Daily alarm count drops from 50 to ~2, and both real alarms map to actual incidents. On-call team burnout reduced; real signal becomes visible again.

When to Use This Tool

•Building CPU utilization alarms that trigger when average CPU exceeds 85% across all instances in a compartment for 5 consecutive minutes
•Creating composite alarms that fire only when both memory utilization exceeds 90% and disk I/O latency exceeds 50ms simultaneously
•Configuring alarm suppressions during scheduled maintenance windows to prevent false alert notifications
•Generating alarms for custom application metrics published via the OCI Monitoring API with appropriate grouping dimensions

Pro Tips

TIP

M-of-N evaluation is OCI's equivalent of CloudWatch's 'datapoints to alarm'. Setting evaluation periods to 5 with 3 datapoints required dramatically reduces noise from transient spikes. A pure 'CPU > 80% for 1 minute' alarm fires constantly during normal autoscaling activity.

TIP

Composite alarms (combining metric conditions with AND/OR logic) cut alert fatigue dramatically. Instead of paging on 'CPU > 80%' which constantly false-alarms, page on 'CPU > 80% AND p95 latency > 500ms' — much higher signal-to-noise.

TIP

Suppression windows are the under-used feature for maintenance. When you're doing planned ops (kernel upgrade, fleet redeploy) that will trigger CPU/disk metrics, set a suppression for the maintenance window so the on-call team isn't paged unnecessarily.

How It Works Under the Hood

The builder constructs OCI alarm definitions with: target metric (compartmentId, namespace, metricName), MQL query (with statistic and grouping), threshold + comparison operator, evaluation periods, severity level, notification topic (OCI Notifications topic OCID), suppression windows, and message format. Output is generated as oci CLI commands and Terraform oci_monitoring_alarm resources.

Frequently Asked Questions

What is MQL (Monitoring Query Language) and how is it used in alarms?: MQL is the query language used to define metric conditions in OCI alarms. A typical MQL query specifies the metric namespace, metric name, statistic, interval, and optional grouping dimensions. For example: CpuUtilization[5m]{availabilityDomain = "AD-1"}.mean() > 80. The alarm evaluates this query at the specified interval and enters FIRING state when the condition is true for the configured number of consecutive evaluation periods.
How do alarm severity levels and notification destinations work?: OCI alarms support four severity levels: CRITICAL, ERROR, WARNING, and INFO. The severity is informational and determines the visual indicator in the console but does not change how the alarm is evaluated. Each alarm sends notifications to an OCI Notification Service topic, which can deliver messages via email, Slack, PagerDuty, HTTPS webhooks, or OCI Functions. You can configure different notification topics for different severity levels.
Can I suppress alarm notifications during maintenance windows?: Yes, OCI supports alarm suppressions that prevent notifications during specified time windows. You define the suppression start time, end time, and an optional description. During the suppression window, the alarm continues to evaluate and change state, but notifications are not sent. This is useful for planned maintenance, deployments, or known capacity changes that would otherwise trigger false alerts.

Related Learning Guides

OCI Cost Optimization Strategies18 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.