The for: 5m property is used to ensure that the rule returns true for X continuous minutes before to trigger the alert. For example, in case that there is a spike in cpu usage for 30 seconds, the alert will not be triggered because we set the for property to 5 minutes. Hence this is not the right property for you.

I believe that you can use the repeat_interval of the alert manager to set the time interval to send notifications. Then you have the alert but you fire/trigger it depending on your repeat_interval. This link explains them in detail.

  • group_wait sets how long to initially wait to send a notification for a particular group of alerts.
  • group_interval dictates how long to wait before sending notifications about new alerts that are added to a group of alerts that have been alerted on before
  • repeat_interval is used to determine the wait time before a firing alert that has already been successfully sent to the receiver is sent again.

In order to put them to work, you have to define label's for each alert. For example, in my alerts.yml file I create labels app_type: server and app_type: service:

groups:
- name: monitor_cpu
  rules:
  - alert: job:node_cpu_usage:percentage_gt_50
    expr: 100 * node_cpu_seconds_total{mode="user"} / ignoring(mode) group_left sum(node_cpu_seconds_total) without(mode) > 5.5
    for: 1m
    labels:
      severity: critical
      app_type: server
    annotations:
      summary: "High CPU usage"
      description: "Server {{ $labels.instance }} has high CPU usage."
- name: targets
  rules:
  - alert: monitor_service_down
    expr: up == 0
    for: 1m
    labels:
      severity: critical
      app_type: service
    annotations:
      summary: "Monitor service non-operational"
      description: "Service {{ $labels.instance }} is down."

then I create a route tree to send notifications to different groups by matching the specific label. And here comes the solution that I use. I define different group_wait, group_interval, and repeat_interval for each group. Then you can use the repeat_interval: 1h and the repeat_interval: 24h in different routes leaf:

global:
  smtp_from: 'mail@gmail.com'
  smtp_smarthost: smtp.gmail.com:587
  smtp_auth_username: 'mail@gmail.com'
  smtp_auth_identity: 'mail@gmail.com'
  smtp_auth_password: ''

route:
  receiver: 'admin-team'
  routes:
    - match_re:
        app_type: (server|service)
      receiver: 'admin-team'
      routes:
      - match:
          app_type: server
        receiver: 'admin-team'
        group_wait: 1m
        group_interval: 5m
        repeat_interval: 1h
      - match:
          app_type: service
        receiver: 'dev-team'
        group_wait: 1m
        group_interval: 5m
        repeat_interval: 24h

receivers:
 - name: 'admin-team'
   email_configs:
   - to: 'admin-mail@gmail.com'

 - name: 'dev-team'
   email_configs:
   - to: 'dev-mail@gmail.com'

Unfortunately, I did not test for 24 hours but with a different gap of minutes and it worked. I think that it will work for long hours as well.

Answer from Felipe on Stack Overflow
🌐
Prometheus
prometheus.io › docs › alerting › latest › configuration
Configuration | Prometheus
The default value of 0s indicates that # no timeout should be applied. # NOTE: This will have no effect if set higher than the group_interval. [ timeout: <duration> | default = 0s ] # Enables updating existing Slack messages instead of creating new ones on alert state change.
🌐
Prometheus
prometheus.io › docs › prometheus › latest › configuration › alerting_rules
Alerting rules | Prometheus
In this case, Prometheus will check that the alert continues to be active during each evaluation for 10 minutes before firing the alert. Elements that are active, but not firing yet, are in the pending state.
Discussions

Can someone please explain Grafana Alerts to me like I'm stupid?
I need to follow this because I have no clue how to set any alerts up. More on reddit.com
🌐 r/grafana
14
15
September 11, 2025
Best practice for using Prometheus with Alloy
I use: count(count_over_time(up[1h])) by (instance) unless count(count_over_time(up[5m])) by (instance) This looks for the up metric over the last 5 mins and compares it to the last hour. If there were up metrics in the last hour BUT there were no recent metrics in the last 5 mins, then the alert triggers. After one hour the up metric no longer exists for the instance, so the no data setting needs to be set to normal so it will place the alert back from 'triggering' to 'normal' state. What this means is that if a node goes offline and stops sending the 'up' metric, we'll get alerted. If we choose to ignore it, the assumption has to be that this is "expected" and the alert goes back to normal. You can play with the time values in the search if you want the alert to remain in 'triggering' mode longer or shorter. But, because Grafana can't differentiate between "oops it's down" versus "this is being retired", the alert has to switch back to normal after some time on its own. More on reddit.com
🌐 r/grafana
4
10
January 2, 2025
Seeking Advice on Prometheus & Grafana: What Metrics Do You Use for Alerts?
Some best practices reading material: Monitoring Distributed Systems Practical Alerting RED Method Best Practices For example, CPU alerts are the opposite of best practices. Visualization Tips Use $__rate_interval and $__range appropriately. Learn and understand what they represent and how they work. More on reddit.com
🌐 r/devops
4
5
August 28, 2024
Alerts repeating more often than they should
I think if additional alerts are generated that change the total number for the group, you’ll get alerted based on group_interval. More on reddit.com
🌐 r/PrometheusMonitoring
3
0
May 2, 2023
Top answer
1 of 1
13

The for: 5m property is used to ensure that the rule returns true for X continuous minutes before to trigger the alert. For example, in case that there is a spike in cpu usage for 30 seconds, the alert will not be triggered because we set the for property to 5 minutes. Hence this is not the right property for you.

I believe that you can use the repeat_interval of the alert manager to set the time interval to send notifications. Then you have the alert but you fire/trigger it depending on your repeat_interval. This link explains them in detail.

  • group_wait sets how long to initially wait to send a notification for a particular group of alerts.
  • group_interval dictates how long to wait before sending notifications about new alerts that are added to a group of alerts that have been alerted on before
  • repeat_interval is used to determine the wait time before a firing alert that has already been successfully sent to the receiver is sent again.

In order to put them to work, you have to define label's for each alert. For example, in my alerts.yml file I create labels app_type: server and app_type: service:

groups:
- name: monitor_cpu
  rules:
  - alert: job:node_cpu_usage:percentage_gt_50
    expr: 100 * node_cpu_seconds_total{mode="user"} / ignoring(mode) group_left sum(node_cpu_seconds_total) without(mode) > 5.5
    for: 1m
    labels:
      severity: critical
      app_type: server
    annotations:
      summary: "High CPU usage"
      description: "Server {{ $labels.instance }} has high CPU usage."
- name: targets
  rules:
  - alert: monitor_service_down
    expr: up == 0
    for: 1m
    labels:
      severity: critical
      app_type: service
    annotations:
      summary: "Monitor service non-operational"
      description: "Service {{ $labels.instance }} is down."

then I create a route tree to send notifications to different groups by matching the specific label. And here comes the solution that I use. I define different group_wait, group_interval, and repeat_interval for each group. Then you can use the repeat_interval: 1h and the repeat_interval: 24h in different routes leaf:

global:
  smtp_from: 'mail@gmail.com'
  smtp_smarthost: smtp.gmail.com:587
  smtp_auth_username: 'mail@gmail.com'
  smtp_auth_identity: 'mail@gmail.com'
  smtp_auth_password: ''

route:
  receiver: 'admin-team'
  routes:
    - match_re:
        app_type: (server|service)
      receiver: 'admin-team'
      routes:
      - match:
          app_type: server
        receiver: 'admin-team'
        group_wait: 1m
        group_interval: 5m
        repeat_interval: 1h
      - match:
          app_type: service
        receiver: 'dev-team'
        group_wait: 1m
        group_interval: 5m
        repeat_interval: 24h

receivers:
 - name: 'admin-team'
   email_configs:
   - to: 'admin-mail@gmail.com'

 - name: 'dev-team'
   email_configs:
   - to: 'dev-mail@gmail.com'

Unfortunately, I did not test for 24 hours but with a different gap of minutes and it worked. I think that it will work for long hours as well.

🌐
SigNoz
signoz.io › guides › what-is-the-alert-lifecycle-of-prometheus
What is the Prometheus Alert Lifecycle - A Guide | SigNoz
August 1, 2024 - These targets can include applications, servers, or any other systems exposing metrics in the Prometheus format. The scraping process occurs at regular intervals, typically every 15 seconds to 1 minute, depending on your configuration.
🌐
OneUptime
oneuptime.com › home › blog › how to implement prometheus alert rule design
How to Implement Prometheus Alert Rule Design
January 30, 2026 - The following example creates an alert that fires when more than 1% of HTTP requests return 5xx errors over the past 5 minutes. groups: - name: http_alerts interval: 30s rules: - alert: HighErrorRate expr: | ( sum(rate(http_requests_total{s...
🌐
Sysdig Docs
docs.sysdig.com › en › sysdig-monitor › prometheus-alerts
Prometheus Alerts | Sysdig Docs
Prometheus Alerts have three states: Resolved, Pending, and Firing. If a duration of 10m is set, it means that the alert condition must be consistently satisfied for a continuous period of 10 minutes before transitioning into the Firing state.
🌐
Medium
medium.com › opsops › prometheus-alerts-testing-you-can-do-less-ef32297cffde
Prometheus alerts testing, you can do less math? | by George Shuklin | OpsOps | Medium
December 29, 2024 - Anyway, your alert is ‘for last 12hours’. If you have a decent scrape_interval of 15 seconds and the default evaluation_interval of 1 minute, and you do a proper testing (before/alert/after), you need to cover 24 hour span for tests.
🌐
Pracucci
pracucci.com › prometheus-understanding-the-delays-on-alerting.html
Prometheus: understanding the delays on alerting
November 16, 2016 - Let’s do an example to better explain the lifecycle of an alert. We do have a simple alert that monitors the load 1m of a node, and fires when it’s higher than 20 for at least 1 minute. ... Prometheus is configured to scrape metrics every 20 seconds, and the evaluation interval is 1 minute.
Find elsewhere
🌐
Last9
last9.io › blog › prometheus-alerting-examples
Prometheus Alerting Examples for Developers | Last9
June 2, 2025 - Prometheus evaluates alert rules based on your global evaluation interval, typically every 15-30 seconds.
🌐
Grafana
grafana.com › docs › grafana › latest › datasources › prometheus › alerting
Prometheus alerting | Grafana documentation
July 15, 2026 - Choose evaluation intervals based on your use case: 15s–30s: Critical infrastructure alerts where fast detection matters. 1m: Standard monitoring alerts (recommended default). 5m: Non-urgent or noisy metrics where you want to reduce evaluation ...
🌐
Google Groups
groups.google.com › g › prometheus-users › c › bUmQmCKSLso
Alerts are getting fire after every minute
February 14, 2025 - alertmanager cannot generate any alert unless Prometheus triggers it. Please go into the PromQL web interface, switch to the "Graph" tab with the default 1 hour time window (or less), and enter the following queries: ... Show the graphs. If they are not blank, then alerts will be generated.
🌐
SigNoz
signoz.io › guides › how do i add alerts to prometheus - step-by-step guide
How Do I Add Alerts to Prometheus - Step-by-Step Guide | SigNoz
August 1, 2024 - Prometheus evaluates alerting rules at regular intervals, typically every 15 seconds by default.
🌐
MetricFire
metricfire.com › blog › top-5-prometheus-alertmanager-gotchas
Top 5 Prometheus Alertmanager Gotchas | MetricFire
October 12, 2023 - It means that Prometheus will check that the alert has been active for 10 minutes before firing the alert to your configured receivers. Also, note that by default alerting rules are evaluated every 1 minute and you can change that via the evaluation ...
🌐
DevOpsil
devopsil.com › home › prometheus › prometheus alerting rules: from noisy to actionable
Prometheus Alerting Rules: From Noisy to Actionable | DevOpsil
March 29, 2026 - It fires when a metric simply doesn't exist in Prometheus — catching cases where a service is completely gone, not just degraded. Complex PromQL in alerting rules runs at every evaluation. For expensive queries, precompute with recording rules: groups: - name: myapp.precompute interval: 30s rules: - record: job:http_requests:rate5m expr: sum by (job, status) (rate(http_requests_total[5m])) - record: job:http_error_rate:ratio5m expr: | sum by (job) (job:http_requests:rate5m{status=~"5.."}) / sum by (job) (job:http_requests:rate5m) - name: myapp.alerts rules: - alert: HighErrorRate expr: job:http_error_rate:ratio5m{job="myapp"} > 0.05 for: 5m labels: severity: critical
🌐
IBM
ibm.com › support › pages › how-can-time-interval-alerts-are-received-be-changed
How can the time interval that alerts are received be changed?
December 30, 2019 - 1. Run the command: kubectl -n sysibm-adm get cm -o yaml prometheus-alertmanager-cm it will return something like: apiVersion: v1 data: alertmanager.yml: |- global: resolve_timeout: 5m · route: receiver: 'webhook' group_by: ['alertname'] group_wait: 30s group_interval: 30s repeat_interval: 1h
🌐
DeepWiki
deepwiki.com › prometheus › alertmanager › 3.3-time-intervals
Time Intervals | prometheus/alertmanager | DeepWiki
Time intervals in Alertmanager allow you to define specific periods of time during which notifications for certain routes are either muted or activated. This feature enables sophisticated time-based r
🌐
Robust Perception
robustperception.io › whats-the-difference-between-group_interval-group_wait-and-repeat_interval
What’s the difference between group_interval, group_wait, and repeat_interval? – Robust Perception | Prometheus Monitoring Experts
December 18, 2017 - Instead we wait for the group_interval since the last notification was sent to the group, and then send all alerts firing (and any resolved alerts) to the receiver. group_wait sets how long to initially wait to send a notification for a particular group of alerts. This allows the Alertmanager to wait for an inhibiting alert to arrive or to collect more initial alerts for the same group. It essentially buffers alerts from Prometheus sent to the Alertmanager that are grouped by the same labels:
🌐
Google Groups
groups.google.com › g › prometheus-developers › c › oBRQwL1qhoc
Alerting within specific time periods
The relevant issue here is https://github.com/prometheus/prometheus/issues/1545 . There has been plenty of discussions here. It's hard because of timezones and DST, as Ben said. And then it's not clear where the logic should live. Alerting expression, or in the alert routing on Alertmanager, or delegate it further down the chain to something like Pagerduty, which obviously is already quite concerned with schedules.
🌐
Prometheus
prometheus.io › docs › tutorials › alerting_based_on_metrics
Alerting based on metrics | Prometheus
... global: scrape_interval: 15s evaluation_interval: 10s rule_files: - rules.yml alerting: alertmanagers: - static_configs: - targets: - localhost:9093 scrape_configs: - job_name: prometheus static_configs: - targets: ["localhost:9090"] - job_name: simple_server static_configs: - targets: ...