# Alerts

Alerts tell you when something needs attention: a run failed, a run is retrying, a run started late, a job was disabled, or a failing job recovered. You create **channels** (where alerts go: email, Slack, Discord, or any webhook) and **rules** (which events, for which jobs, go to which channels). Alerts are written to a durable outbox in the same transaction as the run's result, so they aren't lost if cronpad restarts, and cooldowns stop a flapping job from flooding you.

- [Channels](channels.md): email, Slack, Discord, generic webhook.
- [Rules](rules.md): events, job selectors, conditions, cooldowns.

## Events

| Event | Fires when |
|---|---|
| `run.failed` | A run ends `failed` (no attempts left, or a fatal error). |
| `run.deferred` | An attempt failed and a retry is scheduled. |
| `run.timeout` | An attempt timed out. |
| `run.sla_breached` | A run started later than its SLA threshold. |
| `run.succeeded` | A run succeeded. Opt-in; mostly useful for testing. |
| `job.recovered` | A job's first successful run after one or more failed runs. |
| `job.auto_disabled` | A job was [auto-disabled](../retries-and-failures/auto-disable.md). |
| `job.completed` | A job's schedule ran out of occurrences. |
| `system.lease_expired` | A run in this workspace had to be redelivered because a worker stopped responding. |
| `workspace.quota_warning` | Monthly usage reaches 80%; owners are emailed once per month when SMTP is configured. |
| `workspace.quota_exceeded` | Monthly usage reaches 100%; owners are emailed once per month when SMTP is configured. |
| `system.degraded` | A self-hosted server encounters a dispatcher or queue failure. Available to self-hosted workspace operators. |

## A good starting setup

1. A channel for your team's Slack channel.
2. A rule: all jobs, events `run.failed`, `job.auto_disabled`, `job.recovered`, cooldown 15 minutes.
3. For critical jobs (tag them `critical`): a second rule with `run.sla_breached` and `run.deferred`, condition `min_attempt: 2`.

Quota notices reach owners independently of rules and bypass ordinary email quotas. Workspace daily alert email caps suppress excess ordinary alerts; the next successful email includes the suppressed count. Suspended workspaces produce no outbound alerts.