# Kibana rule - raise alert when CPU is over 90% for the last 5 min **URL:** \ **Category:** Kibana\ **Created:** [October 4, 2023, 2:58pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404 "2023-10-04T14:58:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![catalin.bulancea](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@catalin.bulancea](https://discuss.elastic.co/u/catalin.bulancea)\ **Post date:** [October 4, 2023, 2:58pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/1 "2023-10-04T14:58:54Z")
Hi gurus, I'm new to Rules in Kibana so I need your help. I need to raise an email alert when the CPU is constantly exceeding 90% for the past 5 minutes. The way I configured the rule is the following: ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/f/cfbc1431b6b9753564d84663c1639061cf4ed5b4.jpeg) The alert is being triggered even if there was only a short few seconds spike over 90% for the CPU in the past 5 minutes. Is this the normal behavior? What I want is to trigger the alarm only if the CPU is staying over 90% for at least 5 minutes. How can I write such a rule? Thank you, Catalin ---
**Author:** ![catalin.bulancea](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@catalin.bulancea](https://discuss.elastic.co/u/catalin.bulancea)\ **Post date:** [October 9, 2023, 1:27pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/2 "2023-10-09T13:27:03Z")
Any replies guys? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 9, 2023, 5:30pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/3 "2023-10-09T17:30:16Z")
Hi @catalin.bulancea Hmm interesting... Is that field absolute or percent? > [@catalin.bulancea](#): > > What I want is to trigger the alarm only if the CPU is staying over 90% for at least 5 minutes. Perhaps try Average... What version are you on? What exact rule are you using? Are you using Group By? ![Screenshot 2023-10-09 at 10.33.00 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/5/1539eed3c042fc987a2c40bf7d3712f58c142349.png) ---
**Author:** ![catalin.bulancea](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@catalin.bulancea](https://discuss.elastic.co/u/catalin.bulancea)\ **Post date:** [October 12, 2023, 12:02pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/4 "2023-10-12T12:02:57Z")
Hi Stephen, The field is absolute, i.e. 0.1 is 10%, 0.9 is 90%. I am on version 7.17.4. The rule I am using is: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/830fbb633abf80237d19ebbf387a0015bda9986d.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/4/d4b99de13e29a593076a4319a2b4c36e832e8fcb.png) So yes, I am using Group by, because there are multiple fields.subsystem that match the fields.system. What if I'd use Min instead of Max? That would mean: if the minimum of the CPU usage is above 90% for the last 5 mins, then the the Max and Average will be above 90% too and it will stay there for the entire 5 min duration. Is my understanding correct? Thanks, Catalin ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 12, 2023, 3:12pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/5 "2023-10-12T15:12:52Z")
Hi @catalin.bulancea Here is the way I think of it / understand it. Say your `host.cpu.usage` is collected every 10s from your hosts. And you have FOR THE LAST 5 Minutes as your criteria, so ~30 samples that are looked at for each 5 MIN Interval **For MAX :** If 1 of those samples is above the Threshold and the other 29 are below. The Max over the 5 Min time frame **IS** met. (You only need 1 for the condition to be met.) **For MIN :** If 1 of those samples is below the Threshold and the other 29 are are above The Min over the 5 Min time frame **IS NOT** met. (You only need 1 for the condition to not be met) .... > [@catalin.bulancea](#): > > Max and Average will be above 90% too and it will stay there for the entire 5 min duration. > Is my understanding correct? So yes, your assumption is correct but it is not the recommended approach because all it takes is 1 sample below the Threshold not to meet the criteria. This is why the vast majority of users use AVG for the case you are describing. If you are concerned perhaps change the window to the last 1 MIN ---
**Author:** ![catalin.bulancea](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@catalin.bulancea](https://discuss.elastic.co/u/catalin.bulancea)\ **Post date:** [October 16, 2023, 4:45pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/6 "2023-10-16T16:45:24Z")
> [@stephenb](#): > > other 29 Hi Stephen, Thank you for your explanations! It makes more sense now. So MIN is not the way to go. I will try the AVG and see how it goes. Could you give me an example how AVG will behave with the 30 samples in the 5 min interval? Thank you, Catalin ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 16, 2023, 5:02pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/7 "2023-10-16T17:02:22Z")
**For AVERAGE :** It will calculate the average (arithmetic mean), so sum all the CPU percentages over the 5 minutes / 30 buckets in the 5 mins, simple direct average calculation Sum the Values / Count of Values. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 13, 2023, 5:03pm UTC](https://discuss.elastic.co/t/kibana-rule-raise-alert-when-cpu-is-over-90-for-the-last-5-min/344404/8 "2023-11-13T17:03:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.