How do Non-Events and AckNak differ? When do I use each?
Non-Events (count-based): Use when monitoring volume of single message type. "Alert if order confirmations <500/hour" (data outage detection), "Alert if API calls from Customer A >1M/month" (billing limit monitoring), "Alert if HL7 ADT admissions Monday 8 AM-5 PM <50/hour" (hospital census anomaly). Evaluates one Log View, counts messages matching criteria, compares to Min/Max thresholds.
AckNak (request-response correlation): Use when monitoring paired message types with timing SLA. "Alert if Payment Request sent but no Payment Acknowledgment received within 30 seconds" (SLA compliance), "Alert if Order Submission sent but no Order Confirmation received within 5 minutes" (missing responses), "Alert if Booking Request sent but Booking Confirmation delayed >10 minutes" (carrier API slowness). Evaluates two Log Views (Request + Response), correlates by business identifier (Transaction ID, Order Number), measures time delta, alerts on missing/delayed responses.
When to combine: E-commerce workflow: Non-Events monitors total order volume (Min 500/hour), AckNak correlates Order Submission → Order Confirmation (5-minute SLA). Both alerts provide different insights: Non-Events catches data outages (orders stop arriving), AckNak catches integration issues (orders arrive but confirmations missing).
Next Step
Need more help? Check the Troubleshooting Overview for all FAQs, or refer to the Configuration Guide to fine-tune your Non-Events monitoring setup.