Обсуждение: Alerts that page for symptoms, not causes

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Перевод недоступен; показан оригинал. Оригинал

The 'alert on symptoms, not causes' rule has one exception I would state: predictive alerts for resources that take time to fix — disk filling at a rate that reaches full in 48 hours, a certificate expiring in 14 days. Those are causes, but alerting on the symptom would be too late.

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Перевод недоступен; показан оригинал. Оригинал

Symptom-based alerting assumes you know the symptoms in advance. For new services the first months of cause-based, noisier alerts teach you what the symptoms are; deleting them too early loses that learning. I would recommend a deliberate phase of broad alerting with a review after each incident, converging on symptom alerts, rather than starting from the end state.