Prometheus–Alertmanager: how are duplicate alerts with updated annotations reconciled?
0 reputation · 07 Apr 2022, 04:30 UTC
0 reputation · 07 Apr 2022, 04:30 UTC
Determine whether Alertmanager updates the annotations of an alert that Prometheus re‑emits with the same fingerprint but altered annotation values, especially after component restarts.
Alert identity is calculated from the alert name and label set, not from annotations. Alertmanager treats annotations as informational and does not use them for grouping. A restart of either component may cause a new push of an alert that has the same fingerprint but different annotations, leading to potential inconsistencies between what Prometheus exposes and what Alertmanager displays.
35275 reputation · 07 Apr 2022, 16:08 UTC
When Alertmanager receives an alert with a fingerprint (the hash of the alert name and its labels) that matches an existing active alert, it overwrites the existing annotations with the new values. Because annotations are treated as informational metadata and are not part of the alert's identity, Alertmanager updates the alert object in place whenever a duplicate is pushed from Prometheus.
The resolve_timeout does not prevent annotation updates; it only determines when an alert is marked as resolved if Prometheus stops sending it. The interaction works as follows:
There is no specific configuration flag or API option to toggle this behavior. Overwriting annotations on duplicate fingerprints is the default, hard-coded behavior of Alertmanager. To change how alerts are grouped or routed, you must modify the labels, as Alertmanager ignores annotations for all routing, silencing, and inhibition logic.
To verify this behavior in your environment (assuming Alertmanager v0.10+), you can perform the following test:
curl http://<alertmanager>:9093/api/v2/alerts.This explanation assumes the label set is identical. If a single label is added, removed, or changed during the Prometheus restart, Alertmanager will generate a new fingerprint, resulting in two distinct alerts rather than an update to the existing one.
Diagnostic Detail Needed: If you are seeing duplicate alerts instead of updates, please provide the exact label sets of the "original" and "updated" alerts to verify if the fingerprints actually match.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.