How-to
Source Silence Detector
Pages you when a Logpush source stops ingesting for more than 15 minutes — catches silent outages where the dashboard still looks fresh.
Jump to section
What it detects
When your Logpush source stops delivering batches successfully, most of the dashboard will still look healthy for a while — Analytics Engine stores 90 days of history, so queries against relative time windows keep returning data. You don't notice the feed is dead until someone spots that the live chart isn't actually updating.
This detector prevents that. It monitors every active source's Last Seen timestamp and alerts the moment a source has been silent longer than your threshold.
How it works
Every minute, a D1 query (not an Analytics Engine query — the whole point is to notice when Analytics Engine might be stale) checks each active source. If now - last_seen_at > silence_minutes, the detector opens a warning alert. If the silence exceeds escalate_minutes, the severity escalates to critical.
Last Seen only advances when a Logpush batch has been fully processed end-to-end — signature verified, analytics written, archive stored, counters updated. It's a strong signal: if it's stale, something is genuinely broken.
Default thresholds
| Threshold | Default | Description |
|---|---|---|
silence_minutes | 15 | Minutes of silence before opening a warning alert |
escalate_minutes | 30 | Minutes of silence before escalating to critical |
15 minutes covers normal Logpush cadence (every 5 minutes) plus retry backoff plus a comfortable noise margin. Customers sending bursty traffic (small sites that quiet down overnight) may want to raise it to 30 / 60.
When the alert fires
- dimension_key:
source:<source_id> - One alert per silent source — multiple sources can be silent independently
- Auto-resolves the instant the next batch lands
- Notification goes to your tenant's default routing, same as every other alert
What to do when it fires
- Check the Sources page — note the source's Last Seen timestamp
- Check your Logpush job in Cloudflare — look for "Last pushed" and any recent errors
- Common causes:
- Logpush job paused or deleted
- Bearer token rotated on the Sources page but Logpush still holds the old value (401)
- Our endpoint returning 5xx to Logpush (we'll have a fix in flight — reach out if alerts continue for >20 minutes)
Why it ships enabled
Ships enabled on every tenant by default. The blast radius is "you get an email when your data stream breaks" — strictly better than a silent outage. If the 15-minute threshold is too sensitive for your traffic pattern, raise it; we don't recommend disabling the detector outright.
Related
- Setting up Logpush — if the alert is triggered by an incomplete source setup
- Alert Investigation — general triage procedures