# Tracing alerts

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Ftraces%2Ftracing-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Ftraces%2Ftracing-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Tracing alerts notify you when spans matching your filters exceed a latency threshold. Use them to catch slow or failing operations on specific services, tags, applications, or subsystems, so you find performance bottlenecks before they affect more users.

A tracing alert evaluates spans you select on the Query step and fires based on how many qualifying spans occur on the Condition step.

## What you need[​](#what-you-need "Direct link to What you need")

* Access to Coralogix with permission to create alerts
* Trace data ingesting from the services you want to monitor

## Build a tracing alert[​](#build-a-tracing-alert "Direct link to Build a tracing alert")

To create a tracing alert, go to **Alerts**, then select **Create alert**. The [alert creation wizard](https://coralogix.com/docs/docs/user-guides/alerting/configuring-alert-definition/.md) opens on the Query step. The Tracing type uses the same four-step flow as every alert (Query, then Condition, then Notification, then Details); the parts below are specific to tracing.

### Query: select spans and filters[​](#query-select-spans-and-filters "Direct link to Query: select spans and filters")

1. On the Query step, select the **Tracing** alert type.

2. Set **Latency is above (ms)** to the maximum latency you tolerate. Spans slower than this value count toward the alert.

3. Narrow the spans with filters:

   <!-- -->

   * **Span tags**: add a tag as a **Key** and **Value** pair to include only matching spans. The value can be matched with **Is**, **Starts with**, **Includes**, or **Ends with**.
   * **Application**, **Subsystem**, and **Services**: scope the alert to specific sources, or leave **All** selected. Each span can carry a different application or subsystem.

### Condition: trace count threshold[​](#condition-trace-count-threshold "Direct link to Condition: trace count threshold")

On the Condition step, define how many qualifying spans trigger the alert:

* Trigger immediately on a match, or require a number of occurrences within a time window.
* The alert fires when the count threshold is met for an aggregated value within the time frame.
* With **Group by** set, matching spans are aggregated by the selected fields, and the alert fires on the unique combination of those values. Only spans that include all selected group-by fields are counted.

For the Notification and Details steps, including routing, cadence, alert scheduling, naming, and labels, see [Configuring an alert definition](https://coralogix.com/docs/docs/user-guides/alerting/configuring-alert-definition/.md). To silence a tracing alert so it can serve as a building block in a flow alert without firing on its own, enable Phantom mode on the Notification step.

## Related resources[​](#related-resources "Direct link to Related resources")

[Configuring an alert definition](https://coralogix.com/docs/docs/user-guides/alerting/configuring-alert-definition/.md)[Notification Center](https://coralogix.com/docs/docs/user-guides/notification-center/introduction/.md)[Cases](https://coralogix.com/docs/docs/user-guides/cases/overview/.md)

## Next steps[​](#next-steps "Direct link to Next steps")

Combine multiple alerts into a sequence-based trigger with [Flow alerts](https://coralogix.com/docs/docs/user-guides/alerting/create-an-alert/flow-alerts/.md).