These indicate something is broken:<\/p>\n\n\n\n These may indicate a problem developing:<\/p>\n\n\n\n Track notable events:<\/p>\n\n\n\n Simple threshold alerts miss gradual degradation. Anomaly detection catches changes that are unusual relative to historical patterns.<\/p>\n\n\n\n Moving Average with Standard Deviation<\/strong><\/p>\n\n\n\n Seasonal Adjustment<\/strong><\/p>\n\n\n\n Deep link traffic follows daily and weekly patterns. Compare the current hour to the same hour on previous days:<\/p>\n\n\n\n This compares Tuesday 2pm to the last 4 Tuesdays at 2pm, accounting for both daily and weekly seasonality.<\/p>\n\n\n\n For critical alerts that require immediate response:<\/p>\n\n\n\n Too many alerts cause people to ignore all of them:<\/p>\n\n\n\n![\"Tolinku](\"https:\/\/tolinku.com\/blog\/wp-content\/uploads\/2026\/03\/screenshot-analytics-1772819420927.png\")
\nThe analytics dashboard with date range selector, filters, charts, and breakdowns.<\/em><\/p>\n\n\n\nWhat to Alert On<\/h2>\n\n\n\n
Critical Alerts (Immediate Action)<\/h3>\n\n\n\n
\n\n
\n Alert<\/th>\n Condition<\/th>\n Severity<\/th>\n Typical Cause<\/th>\n<\/tr>\n<\/thead>\n \n Open rate crash<\/td>\n Open rate drops below 40% for 1 hour<\/td>\n Critical<\/td>\n AASA\/assetlinks.json down or misconfigured<\/td>\n<\/tr>\n \n Error rate spike<\/td>\n Error rate exceeds 5% for 15 minutes<\/td>\n Critical<\/td>\n Server error, broken route<\/td>\n<\/tr>\n \n Zero traffic<\/td>\n No clicks for 30+ minutes during business hours<\/td>\n Critical<\/td>\n DNS issue, server down<\/td>\n<\/tr>\n \n Fallback rate spike<\/td>\n Fallback rate exceeds 60% for existing users<\/td>\n Critical<\/td>\n Universal Links \/ App Links broken<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n Warning Alerts (Investigate)<\/h3>\n\n\n\n
\n\n
\n Alert<\/th>\n Condition<\/th>\n Severity<\/th>\n Typical Cause<\/th>\n<\/tr>\n<\/thead>\n \n Conversion drop<\/td>\n Conversion rate drops 30%+ vs 7-day average<\/td>\n Warning<\/td>\n Landing page issue, offer expired<\/td>\n<\/tr>\n \n Latency increase<\/td>\n Average latency exceeds 500ms for 30 minutes<\/td>\n Warning<\/td>\n Server performance degradation<\/td>\n<\/tr>\n \n Platform divergence<\/td>\n iOS and Android open rates diverge by 20%+<\/td>\n Warning<\/td>\n Platform-specific configuration issue<\/td>\n<\/tr>\n \n Campaign underperformance<\/td>\n Campaign CTR below 50% of baseline<\/td>\n Warning<\/td>\n Poor targeting, creative fatigue<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n Informational Alerts (FYI)<\/h3>\n\n\n\n
\n\n
\n Alert<\/th>\n Condition<\/th>\n Severity<\/th>\n<\/tr>\n<\/thead>\n \n Traffic spike<\/td>\n Clicks exceed 200% of normal for the hour<\/td>\n Info<\/td>\n<\/tr>\n \n New country detected<\/td>\n Significant traffic from a country not in top 20<\/td>\n Info<\/td>\n<\/tr>\n \n Budget threshold<\/td>\n Campaign spend reaches 80% of budget<\/td>\n Info<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n Alert Architecture<\/h2>\n\n\n\n
Components<\/h3>\n\n\n\n
Data Pipeline \u2192 Aggregation \u2192 Rule Engine \u2192 Notification Router\n \u251c\u2192 Slack\n \u251c\u2192 Email\n \u251c\u2192 PagerDuty\n \u2514\u2192 Webhook\n<\/code><\/pre>\n\n\n\nImplementation<\/h3>\n\n\n\n
interface AlertRule {\n id: string;\n name: string;\n metric: string;\n condition: {\n type: 'threshold' | 'percentage_change' | 'anomaly';\n operator: 'above' | 'below';\n value: number;\n window: string; \/\/ "15m", "1h", "24h"\n baseline?: string; \/\/ "7d_average", "previous_period"\n };\n severity: 'critical' | 'warning' | 'info';\n notifications: {\n channels: string[]; \/\/ Slack channels, email addresses\n cooldown: string; \/\/ "15m", "1h" - minimum time between alerts\n };\n filters?: {\n platform?: string;\n route?: string;\n campaign?: string;\n };\n}\n\nconst alertRules: AlertRule[] = [\n {\n id: 'open-rate-crash',\n name: 'Deep Link Open Rate Crash',\n metric: 'open_rate',\n condition: {\n type: 'threshold',\n operator: 'below',\n value: 40,\n window: '1h'\n },\n severity: 'critical',\n notifications: {\n channels: ['#deep-links-critical', 'oncall@company.com'],\n cooldown: '15m'\n }\n },\n {\n id: 'conversion-drop',\n name: 'Conversion Rate Drop',\n metric: 'conversion_rate',\n condition: {\n type: 'percentage_change',\n operator: 'below',\n value: -30,\n window: '4h',\n baseline: '7d_average'\n },\n severity: 'warning',\n notifications: {\n channels: ['#deep-links-alerts'],\n cooldown: '1h'\n }\n }\n];\n<\/code><\/pre>\n\n\n\nEvaluation Loop<\/h3>\n\n\n\n
async function evaluateAlerts(rules: AlertRule[]) {\n for (const rule of rules) {\n \/\/ Check cooldown\n if (isInCooldown(rule.id)) continue;\n\n \/\/ Get current metric value\n const currentValue = await getMetricValue(\n rule.metric,\n rule.condition.window,\n rule.filters\n );\n\n \/\/ Evaluate condition\n let triggered = false;\n\n switch (rule.condition.type) {\n case 'threshold':\n triggered = rule.condition.operator === 'below'\n ? currentValue < rule.condition.value\n : currentValue > rule.condition.value;\n break;\n\n case 'percentage_change':\n const baseline = await getBaselineValue(\n rule.metric,\n rule.condition.baseline || '7d_average',\n rule.filters\n );\n const change = ((currentValue - baseline) \/ baseline) * 100;\n triggered = rule.condition.operator === 'below'\n ? change < rule.condition.value\n : change > rule.condition.value;\n break;\n\n case 'anomaly':\n triggered = await isAnomaly(rule.metric, currentValue, rule.condition.window);\n break;\n }\n\n if (triggered) {\n await sendAlert(rule, currentValue);\n setCooldown(rule.id, rule.notifications.cooldown);\n }\n }\n}\n<\/code><\/pre>\n\n\n\nAnomaly Detection<\/h2>\n\n\n\n
Statistical Methods<\/h3>\n\n\n\n
function detectAnomaly(\n current: number,\n history: number[],\n sensitivity: number = 2 \/\/ standard deviations\n): { isAnomaly: boolean; zScore: number; expected: number } {\n const mean = history.reduce((sum, v) => sum + v, 0) \/ history.length;\n const variance = history.reduce((sum, v) => sum + Math.pow(v - mean, 2), 0) \/ history.length;\n const stdDev = Math.sqrt(variance);\n\n const zScore = stdDev > 0 ? (current - mean) \/ stdDev : 0;\n\n return {\n isAnomaly: Math.abs(zScore) > sensitivity,\n zScore,\n expected: mean\n };\n}\n\n\/\/ Usage\nconst last7Days = await getHourlyValues('open_rate', 7);\nconst currentHour = await getCurrentHourValue('open_rate');\nconst result = detectAnomaly(currentHour, last7Days);\n\nif (result.isAnomaly) {\n console.log(`Anomaly detected: open rate is ${currentHour}%, expected ~${result.expected}%`);\n}\n<\/code><\/pre>\n\n\n\nSELECT\n AVG(open_rate) AS expected_open_rate,\n STDDEV(open_rate) AS stddev_open_rate\nFROM hourly_metrics\nWHERE EXTRACT(HOUR FROM timestamp) = EXTRACT(HOUR FROM NOW())\n AND EXTRACT(DOW FROM timestamp) = EXTRACT(DOW FROM NOW())\n AND timestamp >= NOW() - INTERVAL '28 days'\n AND timestamp < NOW() - INTERVAL '1 day';\n<\/code><\/pre>\n\n\n\nNotification Channels<\/h2>\n\n\n\n
Slack Notifications<\/h3>\n\n\n\n
async function sendSlackAlert(\n webhookUrl: string,\n rule: AlertRule,\n currentValue: number\n) {\n const severityEmoji = {\n critical: ':rotating_light:',\n warning: ':warning:',\n info: ':information_source:'\n };\n\n const message = {\n blocks: [\n {\n type: 'header',\n text: {\n type: 'plain_text',\n text: `${severityEmoji[rule.severity]} ${rule.name}`\n }\n },\n {\n type: 'section',\n fields: [\n { type: 'mrkdwn', text: `*Metric:* ${rule.metric}` },\n { type: 'mrkdwn', text: `*Current:* ${currentValue}` },\n { type: 'mrkdwn', text: `*Threshold:* ${rule.condition.operator} ${rule.condition.value}` },\n { type: 'mrkdwn', text: `*Window:* ${rule.condition.window}` }\n ]\n },\n {\n type: 'actions',\n elements: [\n {\n type: 'button',\n text: { type: 'plain_text', text: 'View Dashboard' },\n url: 'https:\/\/app.tolinku.com\/analytics'\n }\n ]\n }\n ]\n };\n\n await fetch(webhookUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application\/json' },\n body: JSON.stringify(message)\n });\n}\n<\/code><\/pre>\n\n\n\nPagerDuty Integration<\/h3>\n\n\n\n
async function sendPagerDutyAlert(\n routingKey: string,\n rule: AlertRule,\n currentValue: number\n) {\n await fetch('https:\/\/events.pagerduty.com\/v2\/enqueue', {\n method: 'POST',\n headers: { 'Content-Type': 'application\/json' },\n body: JSON.stringify({\n routing_key: routingKey,\n event_action: 'trigger',\n payload: {\n summary: `${rule.name}: ${rule.metric} is ${currentValue} (threshold: ${rule.condition.value})`,\n severity: rule.severity === 'critical' ? 'critical' : 'warning',\n source: 'deep-link-analytics',\n component: 'deep-links',\n custom_details: {\n metric: rule.metric,\n current_value: currentValue,\n threshold: rule.condition.value,\n window: rule.condition.window\n }\n }\n })\n });\n}\n<\/code><\/pre>\n\n\n\nAlert Best Practices<\/h2>\n\n\n\n
Avoid Alert Fatigue<\/h3>\n\n\n\n