CoIsland
Start for free

Monitor Snowflake from an island on your Mac

Monitor Snowflake with read-only SQL. A failed task, a row that breaks a rule or a sudden spike reaches an island on your Mac, and Cortex Code, Claude Code or Codex can take it from there.

Set it up Start for free

What CoIsland watches in Snowflake

Each monitor kind brings its own query and its own card in the island.

How to monitor Snowflake: Custom SQL or Validation

A Snowflake monitor is a query CoIsland runs on a schedule through your account’s SQL API. Start from a blank monitor or from an example: impossible ages, missing emails, failed tasks, large orders, unknown browsers.

Custom SQL: a Snowflake SQL alert on any query

Write any SELECT, WITH or SHOW statement: every row it returns is watched. The editor lists the tables it reads, and Test runs it once without saving or alerting. Under Advanced, name the columns that identify a row (like ORDER_ID), how a row reads in the island ({ORDER_ID} {CUSTOMER}), and another warehouse, database or schema.

New Custom SQL monitor for Snowflake: a title and the connector it runs on, a SQL box that runs only SELECT, WITH and SHOW, a Test button, then the alert rule, the sound and the schedule.
The Custom SQL editor: the query and Test, then the rule, the interval and the sound.

Validation: data quality checks without writing SQL

A Validation monitor finds the rows of one table that break one rule: a table, a column and a condition (is null, is null or empty, greater than, less than, equal to, not equal to, not in set). CoIsland writes the SQL and shows it: orders, order_amount and “is greater than 1000” becomes SELECT * FROM orders WHERE order_amount > 1000. Anything but a plain number is quoted as text, so nothing you type turns into SQL.

New Validation monitor for Snowflake: a table, a column and a condition, a Test button, then the alert rule, the sound and the schedule.
Validation: a table, a column and a condition, then the same alert settings as Custom SQL.

When a monitor alerts

A check compares up to 10,000 rows; past that it compares nothing and asks you to narrow the query. Checks run every 15 minutes by default, from 30 seconds to 30 days.

The Big orders monitor page in CoIsland: 6 matching rows, 4 new, the last and next check, a chart of matching rows with yellow points at the checks where rows entered, and the alerts it raised.
A monitor's page: matching rows over time. Yellow points are checks where rows entered.

Three Snowflake alerts worth setting up

Each example is a complete watch file: -- key: value lines for the settings, then the SQL. Save one in ~/.coisland/watches and it appears in Monitors a second later.

A Snowflake task failure alert

TASK_HISTORY covers the last seven days. This monitor keeps the failed runs of the last hour and alerts once per run, error included:

-- name: Failed tasks
-- connector: acme
-- database: ANALYTICS
-- every: 5m
-- alert: new-rows
-- key: QUERY_ID
-- title: {NAME} failed: {ERROR_MESSAGE}
SELECT query_id, name, state, error_message, scheduled_time
FROM TABLE(INFORMATION_SCHEMA.TASK_HISTORY(
    SCHEDULED_TIME_RANGE_START => DATEADD('hour', -1, CURRENT_TIMESTAMP()),
    ERROR_ONLY => TRUE))
WHERE state IN ('FAILED', 'FAILED_AND_AUTO_SUSPENDED')

It reads the current database, hence the database line, and only the tasks your role owns or may monitor. The step-by-step guide starts from scratch.

Rows that break a data quality rule

Duplicates need more than one column, so this rule is Custom SQL. The key line makes a third copy of the same order the same problem, not a new one.

-- name: Duplicate orders
-- connector: acme
-- every: 1h
-- key: ORDER_ID
SELECT order_id, COUNT(*) AS copies
FROM sales.public.orders
GROUP BY order_id
HAVING COUNT(*) > 1

A spike: more than N rows

This count rule speaks up when more than 20 queries failed in 15 minutes:

-- name: Failed query spike
-- connector: acme
-- database: ANALYTICS
-- every: 15m
-- alert: count > 20
SELECT query_id, user_name, warehouse_name, error_message
FROM TABLE(INFORMATION_SCHEMA.QUERY_HISTORY(
    END_TIME_RANGE_START => DATEADD('minute', -15, CURRENT_TIMESTAMP()),
    RESULT_LIMIT => 10000))
WHERE error_code IS NOT NULL

Without RESULT_LIMIT, QUERY_HISTORY stops at 100 rows. The form in Settings writes these same files, so you can review monitors in a pull request and keep them in git. Watch files lists every setting.

What a Snowflake alert on your Mac shows

When a monitor fires, the island unfolds for five seconds with its new rows and plays its sound. The alert then waits in Alerts: what the monitor expected, what it observed and when, the rows that fired it as they read then (up to 200), and Copy CSV. Acknowledge it, resolve it, or add notes to its activity.

An alert in CoIsland: 1 new row in Big orders, still New, observed against expected, the row that fired it, its monitor, rule, connector and table, its activity, and buttons to hand it to Claude Code, Codex or Cortex Code.
A Snowflake alert: expected, observed, detected, the row that fired it, and the agents at its foot.

Hand it to Cortex Code, Claude Code or Codex

One click at the foot of an alert starts an agent in a terminal under it. Its first message is the whole alert: facts, the monitor’s SQL, every kept row as CSV, and the activity. The agent is asked to find the cause, fix what is safe and can be undone, and ask you before anything destructive. Claude Code and Codex start in their auto modes, Cortex Code in its default Confirm mode. Resolving the alert stays yours. Cortex Code is Snowflake’s own agent and reads the same ~/.snowflake connections. More on agents.

Claude Code's terminal under a CoIsland alert: it proposes to verify the order with a read-only query, look into a timestamp gap, adjust the monitor or do nothing, and asks which one.
Claude Code under a Snowflake alert: four next steps, then it waits for your answer.

Read-only, signed in with a token, cheap to run

A programmatic access token that stays on your Mac

Generate the token in Snowsight under Governance & security, Users & roles, your user. Snowflake shows it once, it expires after 15 days unless you choose longer (365 at most), and by default the user must be under a network policy to use it. Restrict it to a read-only role and even a leaked token cannot change data. CoIsland keeps it in a file only you can read, next to ~/.snowflake/connections.toml, and sends it only to your account’s host. Every step: Connect Snowflake.

New Snowflake connector form: account identifier, user and connector name, then the programmatic access token, role, warehouse, database and schema, and a Test connector button.
A new Snowflake connector. Test connector signs in and asks who it is; nothing is saved.

What checks cost

Every check runs on a warehouse, and Snowflake bills at least one minute each time a warehouse resumes. CoIsland keeps that down: 15 minutes between checks by default, checks aligned to the clock so monitors with the same interval share one resume, none while your Mac sleeps. A dedicated XS warehouse with a short auto-suspend does the rest:

CREATE WAREHOUSE IF NOT EXISTS coisland_wh
  WAREHOUSE_SIZE = XSMALL
  AUTO_SUSPEND = 60
  AUTO_RESUME = TRUE
  INITIALLY_SUSPENDED = TRUE;

Already on Snowflake’s own alerts? See how CoIsland compares, then CoIsland for data teams and every connector.

Connect it in three steps

  1. In Snowsight, generate a programmatic access token for your user, restricted to a role that can read what you watch.

  2. Add a Snowflake connector: account, user, token, role and warehouse, then Test connector. Or import a token connection from the Snowflake CLI.

  3. Create a Custom SQL or Validation monitor, its rule and its interval: 15 minutes unless you change it.

Built for Snowflake

  • Read-only by design: only SELECT, WITH or SHOW ever runs.
  • Talks only to your account's SQL API: no CoIsland server or account.
  • Imports your Snowflake CLI and Cortex Code connections, and never writes to ~/.snowflake.
  • Each monitor is a .sql file in ~/.coisland/watches, easy to keep in git.
  • Checks line up on the clock: monitors on one interval share a warehouse resume.

Then hand it to an agent

A click on the alert opens the agent in a terminal under it, with the whole alert as its first message.

Snowflake questions

How do I get an alert when a Snowflake task fails?

Create a Custom SQL monitor on INFORMATION_SCHEMA.TASK_HISTORY that keeps the runs whose state is FAILED, and alert on new rows. Each failed run then reaches the island once, with its error message. The role needs OWNERSHIP, MONITOR or OPERATE on the tasks, or MONITOR EXECUTION on the account.

Can CoIsland change or delete data in Snowflake?

No. A Snowflake monitor must start with SELECT, WITH or SHOW, and CoIsland refuses any other statement before it reaches Snowflake. Restrict the token to a role that can only read, and the token itself cannot write either.

Which Snowflake authentication does CoIsland support?

A programmatic access token, sent to the SQL API. A connection set to another authenticator (browser SSO, key pair, password) is refused with a message that says why. By default, Snowflake only accepts a token from a user who is subject to a network policy.

Does monitoring Snowflake use warehouse credits?

Yes. Each check runs its query on a warehouse, and Snowflake bills at least one minute each time a warehouse resumes. Keep the 15-minute default, use an XS warehouse with a short AUTO_SUSPEND, and give monitors the same interval so they share one resume.

Where does CoIsland keep my Snowflake token?

On your Mac, in your login Keychain, like every connector's token; the connector's other settings are in CoIsland's own connectors.json. The token only travels to your account's host: CoIsland never follows a redirect with it.

Can I reuse my Snowflake CLI or Cortex Code connection?

Yes, if it signs in with a programmatic access token (authenticator PROGRAMMATIC_ACCESS_TOKEN, with token, token_file_path or password). The first time CoIsland starts, it imports those connections under the same names, token included; later, Import from Snowflake CLI in the Snowflake form fills it from one. CoIsland reads ~/.snowflake the way the Snowflake CLI does and never writes to it.

How is CoIsland different from Snowflake alerts?

Snowflake alerts (CREATE ALERT) run inside your account and send an email or a webhook. CoIsland checks from your Mac: the rows that fired land in the island and go straight to an agent if you want. You can keep both.

Other connectors

Work with AI. Stay in control.

CoIsland Community is free, for good. Lifetime from $29, paid once. Native for Apple Silicon, macOS 14 and later.

Start for free Buy Lifetime