Press New rule. A rule is one sentence: when a machine (or any machine, a tag or a site) does something, alert at a severity.
Pick the condition in the second box, such as cpu above, a service failed or error logs more than, and type its number or name.
Set how long it must hold (for N min), how often it repeats (blank means once) and quiet hours such as 22-7.
Read the preview line under the rule: it replays the rule over the history there is and says what it would have done.
Press Save. A rule you do not need right now can be switched off with its switch instead of deleted.
Something not working?
Log rules ("error logs more than") need the observability server. Without one the rule says so under its sentence and starts working the day a server is saved. Install one from the Logs screen.
A rule never fires: check the machine is in its target, the switch is on, and the grace time is not longer than the problem lasts.
The preview says it would not have fired: the history may be short; change the number and watch the preview move.
Alerts arrive on the Alerts screen first; phone alerts need ntfy or Telegram in Settings > Notifications.
