---
key: check-why-a-signal-did-not-match
title: Check why a signal did or did not match a rule
audience: staff
section: critical-alerts
routes: ["/critical-alerts/signals/:signalUid"]
permissions: ["critical_alerts.view"]
features: ["critical_alerts.core"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Open one signal to see exactly what the device sent, which rules Nova checked it against and which match field failed, then fix the rule.
keywords: [alarm did not ring, no incident, unmatched, why no alert, event name, what did the device send, rule not matching, troubleshoot, wrong rule fired]
related: [review-and-replay-signals, create-a-critical-alert-rule, publish-a-critical-alert-draft, work-a-critical-alert-incident]
---

In the sidebar, open **Critical Alerts**, then **Signals**, and press **Open** on the signal's row (or click the row). The page address is `/critical-alerts/signals/` followed by the signal.

The signal opens as **Signal detail**, a panel over the signals list. Close it to go back to the list. The panel has no buttons: it shows everything Nova recorded about the signal as raw text, one detail per line, with the detail's name before the colon. This article tells you which lines to read.

## Before you start

- Your admin has to give your role permission to view critical alerts. Fixing the rule afterwards needs permission to manage rules.
- If the signal is not in the list at all, it never reached Nova. See [[critical-alerts-04-sources-and-incoming-webhooks]].

## Steps

1. Open the signal and find `status` near the top. It says what happened to the signal (see below).
2. Read `event_name`, `signal_type`, `severity` and `title`. That is what the device sent, as Nova read it.
3. Scroll to `matched_rules`. There is one block per published rule Nova checked, in evaluation order, each named by the rule's **Key** on the `rule_key` line. Nova stops at the first rule that matches, so when a rule matched, it is the last block.
4. In the block for the rule you expected, check `source_bound`. `false` means the rule listens to a different source.
5. Under `results`, read each comparison: `field` is what was compared, `expected` is what the rule wants, `actual` is what the signal carried, and `matched` is `true` or `false`.
6. Open **Rules**, press **Edit** on that rule, and change **Match event name**, **Match signal type** or **Match title contains** to what the signal actually carried.
7. Save the rule, then press **Publish** on its row. Only published rules are checked.
8. Go back to **Signals** and press **Replay** on the signal. Nova runs it through the rules again; see [[review-and-replay-signals]].

## What you see

What `status` means:

- `unmatched`: no published rule matched. `matched_rules` shows why each one failed.
- `open`: it matched a rule and opened a new incident.
- `suppressed`: it opened an incident, but a suppression window held back the calls and messages.
- `grouped`: it matched and joined an incident that was already open.
- `resolved`: a clear signal closed the open incident.
- `ignored`: a clear signal arrived, but there was no open incident to close.

Other useful lines:

- `context`, inside each rule's block, lists the values Nova compared. The event name, signal type and severity are shown in lower case.
- `payload_json` is what the outside system sent, exactly as it arrived; `normalized_payload_json` is what Nova read from it.
- `occurred_at` and `processed_at` are when the signal happened and when Nova handled it.

## If something looks different

- `matched_rules` is empty: no rule was published when the signal arrived. Draft rules are never checked; see [[publish-a-critical-alert-draft]].
- `actual` and `expected` differ only in capital letters: that is not the cause, because Nova ignores capital letters. Look for a spelling difference, a space or an underscore.
- The wrong rule matched: a rule earlier in the order matched first. Put the more specific rule higher with **Manage evaluation order** on **Rules**.
- Nova says "Signal doesn't exist." and shows the signals list: Nova cannot find that signal in the organization you are signed in to.
- The panel does not link to the incident or rule. Find the incident by its title under **Incidents**, and the rule by its key under **Rules**.

[[route:/critical-alerts/signals|Open Signals]]