Enable Notifications

Magic Transit customers can configure Magic Tunnel health alerts to receive email, webhook, and PagerDuty notifications when the percentage of successful health checks for a Magic Tunnel drops below the selected service-level objective (SLO).

Magic Tunnel health alerts will monitor the health check success rate of each Magic Tunnel included in the alert that has actively transferred customer traffic (excluding health check traffic) over the past six hours. Customers can define an SLO threshold for the percentage of health checks that must be successful for each Magic Tunnel. If the number of successful health checks for the Magic Tunnel(s) included in the alert drops below the SLO threshold, then an alert will fire.

Alert data

If a Magic Tunnel health alert is fired, customers can expect the following data in the email, webhook, and PagerDuty notification:

Cloudflare account name
Cloudflare account ID
Alert type
Tunnel name
Tunnel ID
Tunnel status
Alert SLO
Timestamp

Log in to your Cloudflare dashboard ↗, and select your account.
Select Notifications > Add.
From the Product drop-down menu, select Magic Transit.
Select Magic Tunnel Health Check Alert > Select to add a notification. You can add alerts by tunnel or by data center (beta).

Alert by tunnel

Select Alert by tunnel.
Enter a name and description for the notification.
Add webhooks or an email address for the person who should receive the notification, and select Next.
Select the Alert Sensitivity Level threshold from the dropdown menu. The threshold is predefined to Medium (98.0). There are options available between Minimum (95.0) and Maximum (99.9). Refer to Magic Tunnel health check calculation for more information on this topic.
From the Alert interval drop-down menu, set the minimum amount of time that must pass before a duplicate alert is sent to you. Options range from five minutes to seven days.
Enable Set as default alert for any new tunnels created in the future if you want the alert sensitivity level you chose to be automatically applied to all new tunnels you create.
Select Next.
Choose the tunnels you want to receive alerts for, and select Next.
Review the details of your alert. If you are happy with them, select Create alert.

Alert by data center (beta)

Select Alert by data center.
Enter a name and description for the notification.
Add webhooks or an email address for the person who should receive the notification, and select Next.
Select the Alert Sensitivity Level threshold from the dropdown menu. The threshold is predefined to Medium (98.0). There are options available between Minimum (95.0) and Maximum (99.9). Refer to Magic Tunnel health check calculation for more information on this topic.
From the Alert interval drop-down menu, set the minimum amount of time that must pass before a duplicate alert is sent to you. Options range from five minutes to seven days.
Choose the data centers you want to receive alerts for, and select Next.
Select the on-ramps for that data center you want to receive alerts for, and select Next.
Review the details of your alert. If you are happy with them, select Create alert.

Send a POST request to create a Magic Transit tunnel health alert. You can set tunnel health alerts with any SLO value between 0 and 99.99.

Required API token permissions

At least one of the following token permissions is required:

Notifications Write
Account Settings Write

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/alerting/v3/policies" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "alert_type": "magic_tunnel_health_check_event",
    "description": "<DESCRIBE_POLICY>",
    "enabled": true,
    "filters": {
        "slo": [
            "99.9"
        ]
    },
    "mechanisms": {
        "email": [
            {
                "id": "EMAIL_ADDRESS"
            }
        ]
    },
    "name": "<DESCRIBE_ALERT>"
  }'

  {
    "result": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "name": "<POLICY_NAME>",
        "description": "<POLICY_DESCRIPTION>",
        "enabled": true,
        "alert_type": "magic_tunnel_health_check_event",
        "mechanisms": {
          "email": [
            {
              "id": "<YOUR_EMAIL>"
            }
          ]
        },
        "created": "2024-09-11T14:13:29.585658Z",
        "modified": "2024-09-11T14:13:29.585658Z",
        "conditions": {
          "and": [
            {
              "or": [
                {
                  "<=": [
                    {
                      "var": "slo"
                    },
                    "99.9"
                  ]
                }
              ]
            }
          ]
        },
        "filters": {
          "slo": ["99.9"]
        }
      }
    ],
    "success": true,
    "errors": [],
    "messages": []
  }

Test SLOs

To test whether a specific alert sensitivity level works for your use case:

Create an alert with a specific sensitivity level for a tunnel with active traffic within the past six hours. If you are not sure of what tunnels to choose, refer to Network Analytics to learn how you can view real-time and historical data about your network.
Disable the tunnel you are testing, so there is 100% health check failure.
The time it takes for Cloudflare to send you an alert will depend on the sensitivity you chose for your alerts.

Other notifications

Cloudflare also recommends that you enable the following account notifications for your Magic Transit service:

Layer 3/4 DDoS Attack Alert
Route Leak Detection Alert (to detect BGP Hijacks)
(Optional) Advanced Layer 3/4 DDoS Attack Alert
(Optional) Cloudflare status - Maintenance Notification (in case you want to be alerted regarding maintenance in specific Cloudflare data centers).

Refer to Cloudflare Notifications for more information on how to enable these notifications.

Was this helpful?

Community
X
Discord
YouTube
GitHub