What is absence detection in a log monitoring tool?

Absence detection fires an alert when a log pattern has NOT appeared for a specified period. Unlike event-driven alerts that react to things that happen, absence detection catches services that silently stop producing output — queues that drain, workers that stall, or connections that time out without logging an error.

How does Agata Stack know a service is silently failing if nothing is being logged?

Agata Stack runs an absence sweep on a 30-second timer independently of the event stream. Every 30 seconds it checks whether each absence rule has seen matching activity within its configured time window. If not, the rule fires. The sweep runs continuously, even on services that appear healthy.

Will absence alerts fire during intentional quiet periods, like overnight?

You control this via the time window and rate limits per rule. Setting a longer window (e.g. 30 minutes instead of 5) reduces false positives during naturally quiet periods. The default serviceSilent rule is also rate-limited to 3 executions per hour with a 5-minute cooldown, so a quiet-but-healthy service will not spam you.

Can I set up absence detection for a specific log pattern, not just any log line?

Yes. The pattern format is text:minutes — for example, worker:poll:5 fires if the text "worker:poll" has not appeared for 5 minutes. An empty text field (written as just :minutes) means any log line at all.

How do I test an absence rule without waiting for a real outage?

The Agata Stack stream rule sandbox includes a Force Evaluate button that triggers the absence evaluation immediately, letting you confirm the rule fires and the timeline entry appears without waiting for the real time window to expire.

Insights

Absence Detection: How to Know When Your Service Silently Stops Logging

Crashes make noise. Silent failures do not. Here is how to catch the worst kind of outage — the service that just quietly stops — before your users do.

Nicolás

July 10, 2026

0 min read

12 views

Agata Stack

stream-rule-automation

Related Insights

Agata Stack

stream-rule-automation

EADDRINUSE at Startup: The Rule That Kills the Port and Restarts Automatically

Every developer has lost five minutes to a port-in-use error at startup. Here is the stream rule that detects EADDRINUSE in your logs, kills the blocking port, and restarts your service — automatically, without a terminal.

log-stream-visibility

The Developer API That Lets You Tail Logs with curl from CI

Agata Stack runs a local HTTP server on port 19877. Tail live logs over SSE, manage services, and hit a self-describing OpenAPI spec — all from a shell script, a CI job, or an AI tool.

log-stream-visibility

Log Fingerprinting: How to Catch the Error That Spams Your Console 400 Times

One error line repeating 400 times looks like noise. But it is a pattern — and the right rule can catch it in the first 5 lines, fire once, and stay quiet after that. Here is how log fingerprinting works in Agata Stack.

Nicolás

Jun 29, 2026

5 min