Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.
An alert is the primary workflow object in Lakewatch. A system error groups system events so you can investigate related system health and configuration issues together. For alerts that group signals (events indicating potential security threats), see Alerts.
How are system errors created?
System errors are created automatically through grouping. When Lakewatch generates a new system event, it groups related system events into a single system error rather than opening a new system error for every event. A new system event attaches to an existing system error (one that's not resolved or marked as a duplicate) when both of the following conditions are met:
- The system event shares the same summary and resource as the system event that opened the existing system error.
- The existing system error was opened within the grouping window, which is configurable per catalog in Settings.
Lakewatch creates a new system error when no matching system error exists, the most recent matching system error was opened before the grouping window, or the matching system error is resolved or marked as a duplicate.
System errors can't be created manually from the UI.
Note
The grouping criteria (system event summary and resource) can't be customized. Only the grouping window duration is configurable, and only at the workspace level.
Working with system errors
Each system error has the following editable attributes:
- Assignee: The user responsible for addressing the system events.
- Title and Description: Summary and details of the system error.
- State: One of Open, In progress, Mitigated, Resolved, Duplicate, or Unspecified.
- Classification: Indicates whether the activity captured in the system error is a real issue. Choose False positive, Benign positive, or True positive.
- Severity: Defaults to Medium. You can manually update severity at any time. Valid values: Informational, Low, Medium, High, or Critical.
- Events: The system events linked to the system error.
Each system error also has the following read-only attributes:
- System error ID: A unique identifier for the system error, generated by the server.
- Total events: The number of system events attached to the system error.
- First event added at: Timestamp of when the first system event was added to the system error.
- Last event added at: Timestamp of when the most recent system event was added to the system error.
- Created by: The user or service principal that created the system error.
- Created at: Timestamp of when the system error was created.
- Updated at: Timestamp of when the system error was last modified.
Work with system errors in the UI
System errors appear as a top-level item in the Lakewatch navigation. On this page, you can:
- View a list of all system errors.
- Search system errors by title or ID.
- Filter system errors by assignee, state, severity, and other attributes. Search and filter selections persist across navigation within Lakewatch, and the active filter state is reflected in the URL. Copy the URL to share or bookmark a filtered view.
- Sort and resize columns, and use the column manager to hide or show columns.
- Open a system error to view its details and edit its attributes.
System error details
Click the title of a system error to open the details page. There, you can view and edit its attributes and see the most recent related system events.
Click the title of a system event to view its details, including the resource involved and the error stack trace.
You can also add comments to a system error from the details page. Comments support Markdown syntax.
Exporting system errors
System errors can be exported to external ticketing and case management systems such as Jira and Tines. Export is configured in workspace settings. For setup and options, see Configure settings.