Alerts

Argus emails your team about new errors, downtime and missed cron runs from the start, with nothing to configure. Alert rules add your own conditions, written as a sentence, and can notify email, Slack or a webhook.

5 min read

Who gets alert emails

Argus's alert emails go to your workspace's alert recipients: every member of the workspace, unless they have muted Observability email under Settings → Notifications. Argus → Settings lists who is on it.

Without any setup, the recipients are emailed when:

Module	Email
Errors	An issue is new, comes back after being resolved, or spikes. At most one email per issue per hour
Uptime	A monitor goes down, and when it is back up. One reminder after 15 minutes if nobody acknowledges it
Cron monitors	A run is missed or fails, and when the job is back on time
Usage	The workspace reaches 80% and 100% of its monthly error allowance

Uptime and cron alerts also go to every channel that is switched on: a monitor going down reaches your Slack channel or webhook as well as the inbox. Error and usage emails go by email only; to send errors to Slack or a webhook, write an alert rule for them.

Alert rules

Open Argus → Alerts and create a rule. A rule reads back as a sentence, so you can check it says what you mean:

When p95 response time of checkout-api is above 700 ms for 15 minutes, tell #ops.

Choose what to watch:

Signal	Value
A metric	A PromQL query, or one built from your metrics, at the moment of checking. A query that returns several series is judged by its worst value
Errors	The number of error events in a time window, from any app or one source
Log lines	The number of log lines matching a search in a time window

Then a comparison (above, at least, below, at most), a threshold, and for a metric, how long the condition must hold before the rule fires.

How a rule behaves

Argus checks every enabled rule every 30 seconds.

Once its condition has held for its duration, the rule fires, opens an incident and notifies once. Staying in that state sends nothing more.
When the value goes back to normal, the incident resolves and one resolved message goes out.
No data never fires a rule.
Rules that fire together are sent together: two rules firing on the same check are one message per channel.

Acknowledge, assign and resolve incidents under Argus → Alerts → Incidents.

Silences

A silence mutes one rule, or every rule, until a time you choose. Incidents still open and resolve while it lasts, so the history stays complete. Nothing is sent.

Channels

A rule with no channel emails the workspace's alert recipients. Add channels under Argus → Alerts → Channels to send elsewhere. A rule can notify up to 10 channels, and Test sends a sample message to check one.

Channel	You provide
Email	1 to 20 addresses
Slack	A Slack incoming-webhook URL, on `hooks.slack.com`
Webhook	An `https://` URL with a hostname, and optionally a signing secret

Slack webhook URLs and webhook secrets are write-only: once saved they are masked, and editing a channel without re-entering them keeps the stored value.

Webhooks

Argus POSTs JSON to the URL:

Webhook body

json

{
  "kind": "firing",
  "workspace": "<workspace id>",
  "title": "…",
  "text": "…",
  "url": "<link to the incident in Argus>",
  "severity": "…",
  "at": "2026-10-27T09:30:00Z",
  "alerts": [
    {
      "ruleId": "…",
      "rule": "…",
      "state": "firing",
      "value": 912.5,
      "sentence": "…",
      "incidentId": 42
    }
  ]
}

kind is firing, resolved or test, and is also sent as the X-Argus-Event header. Uptime and cron alerts use the same body: alerts holds one entry whose rule names what sent it (such as "Monitor down from 2 locations"), with ruleId empty and no value, and url links to the monitor's incident.

The URL must not contain credentials, and must not be an IP address. Argus refuses to deliver to private, loopback or link-local addresses, and doesn't follow redirects.

Verifying the signature

With a signing secret (at least 16 characters), each request carries two more headers:

Header	Value
`X-Argus-Timestamp`	Unix seconds when the message was made
`X-Argus-Signature`	`sha256=` and the hex HMAC-SHA256 of `<timestamp>.<raw body>` with your secret

Compute the same HMAC over the raw body and compare before trusting the request:

Node.js

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody, headers, secret) {
  const ts = headers['x-argus-timestamp'];
  const expected =
    'sha256=' +
    createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex');
  const got = headers['x-argus-signature'] ?? '';
  return (
    got.length === expected.length &&
    timingSafeEqual(Buffer.from(got), Buffer.from(expected))
  );
}