Snowflake Alerts and Notifications

Nobody watches a dashboard all day. Credit spikes, failed loads, and stalled pipelines still need fast attention. Snowflake alerts check a condition on a schedule and run an action when the condition holds. A short email reaches the right person before a small issue grows into a large one.

The Smoke Detector Comparison

A smoke detector checks the air all day without human effort. It stays silent in normal conditions and sounds the alarm when smoke appears. An alert follows the same pattern. A scheduled SQL check acts as the sensor, and an email or other action acts as the alarm.

HOW AN ALERT RUNS
=================

 Every 30 minutes
        |
        v
 +----------------------+   no rows    +----------------+
 |   CONDITION QUERY    |------------->|  Do nothing    |
 |  (does bad data      |              +----------------+
 |   exist?)            |
 +----------+-----------+
            | rows found
            v
 +----------------------+
 |       ACTION         |  send email, write log row, call procedure
 +----------------------+

Step One: Create a Notification Integration

Emails leave Snowflake through a notification integration. The integration lists approved recipients, and Snowflake blocks messages to any other address.

CREATE NOTIFICATION INTEGRATION ops_email
  TYPE = EMAIL
  ENABLED = TRUE
  ALLOWED_RECIPIENTS = ('ops-team@example.com', 'data-lead@example.com');

Recipients must be verified Snowflake users with confirmed email addresses.

Step Two: Create the Alert

CREATE OR REPLACE ALERT failed_loads_alert
  WAREHOUSE = admin_wh
  SCHEDULE  = '30 MINUTE'
  IF (EXISTS (
    SELECT 1
    FROM TABLE(INFORMATION_SCHEMA.COPY_HISTORY(
      TABLE_NAME => 'RAW_ORDERS',
      START_TIME => DATEADD('minute', -30, CURRENT_TIMESTAMP())))
    WHERE status = 'LOAD_FAILED'
  ))
  THEN
    CALL SYSTEM$SEND_EMAIL(
      'ops_email',
      'ops-team@example.com',
      'Snowflake alert: load failures',
      'One or more files failed to load into RAW_ORDERS in the last 30 minutes.'
    );

-- New alerts start suspended
ALTER ALERT failed_loads_alert RESUME;

The IF clause holds a condition. The alert fires when EXISTS finds at least one row. The action clause holds the action.

Schedules

FORMAT                              MEANING
----------------------------------  ----------------------------
'30 MINUTE'                         Every 30 minutes
'USING CRON 0 8 * * MON-FRI UTC'    8:00 AM UTC on weekdays
'USING CRON */15 * * * * UTC'       Every 15 minutes

Useful Alert Ideas

ALERT IDEA                CONDITION
------------------------  -------------------------------------------------
Credit spike              Daily credits above a set number
Failed pipeline task      Task history shows FAILED in the last hour
Long-running query        Query running longer than 30 minutes
Empty daily load          Zero rows loaded since midnight
Login failures            Many failed sign-ins in a short window

Credit Spike Example

CREATE OR REPLACE ALERT daily_credit_spike
  WAREHOUSE = admin_wh
  SCHEDULE  = 'USING CRON 0 * * * * UTC'
  IF (EXISTS (
    SELECT 1
    FROM SNOWFLAKE.ACCOUNT_USAGE.METERING_DAILY_HISTORY
    WHERE usage_date = CURRENT_DATE()
    GROUP BY usage_date
    HAVING SUM(credits_used) > 200
  ))
  THEN CALL SYSTEM$SEND_EMAIL('ops_email', 'ops-team@example.com',
       'Credit spike', 'Today credit usage passed 200.');

Account Usage views lag behind real time by up to a few hours, so use Information Schema functions for near-instant checks.

Managing Alerts

SHOW ALERTS;
ALTER ALERT failed_loads_alert SUSPEND;
DROP ALERT failed_loads_alert;

-- History of evaluations and actions
SELECT name, state, scheduled_time, error_message
FROM TABLE(INFORMATION_SCHEMA.ALERT_HISTORY())
ORDER BY scheduled_time DESC
LIMIT 20;

Cost Notes

Each alert evaluation uses the named warehouse, or serverless compute when no warehouse appears. Choose a small warehouse and sensible schedules. Checking every minute rarely adds value and adds credit use.

Other Notification Paths

• Resource monitors send emails at credit thresholds.
• Task error integrations notify teams when a task fails.
• Webhook integrations post messages to chat tools.

A Practical Scenario

A data team loads orders every hour through a pipeline. One morning the pipeline stalls, and the dashboard shows yesterday's numbers until someone notices at noon. The team creates an alert that checks the latest load time every thirty minutes. When the newest row is older than two hours, the alert emails the on-call engineer. A later stall triggers a message within half an hour, and the engineer restarts the pipeline before business users notice any gap.

Frequently Asked Questions

How do I test an alert condition?

Run the condition query by itself in a worksheet and confirm it returns rows only when the problem exists.

Can an alert call a stored procedure?

The action section accepts a CALL statement, so alerts can log events, retry jobs, or send messages to other systems.

Avoiding Alert Fatigue

Too many messages train people to ignore every message. Reserve alerts for problems that need action. Set thresholds based on normal behavior, group related conditions into one message, and review alert history each month. Retire alerts that fire often without leading to action.

Permissions

Creating an alert needs the CREATE ALERT privilege on the schema and the EXECUTE ALERT privilege on the account. Using an email integration needs usage on that integration. Grant these rights to a dedicated monitoring role rather than to every developer.

Key Points

• An alert pairs a scheduled condition with an action.
• Notification integrations control which addresses may receive email.
• Alerts start suspended and need ALTER ALERT RESUME.
• Schedules accept minute intervals or cron expressions.
• ALERT_HISTORY records every evaluation and result.
• Small warehouses and moderate schedules keep alert costs low.