In monitoring, an incident is a record of a problem that has been confirmed. It has a start, an end, and usually a cause. It is the unit you read in the history: what failed, when, for how long, and why.
Failed check, incident, downtime
The words are close, and they are not the same.
| Term | What it is |
|---|---|
| Failed check | One request that did not get a good answer. It may be a blip |
| Incident | A confirmed problem, built from failed checks, with a start and an end |
| Downtime | The time the service was not usable. Incidents are how monitoring measures it |
| Warning | A notice that something will go wrong soon, such as a certificate close to its end date. No failure has occurred yet |
A single failed check is a signal, not a verdict. Monitoring tools wait for confirmation before they call something an incident, so that a lost packet does not wake anyone. How this works, and what can still go wrong, is covered in Why Uptime Monitors Send False Alerts.
An incident is the measured form of downtime, and it is what uptime figures are subtracted by.
Monitoring is not incident management
Google's SRE book treats incident management as a discipline of its own, with roles, communication, and a person in charge. It describes criteria for declaring an incident, such as whether customers can see the failure. A monitor feeds that process by detecting the problem and recording its timeline. It does not run the response.
Incidents in UptimeWire
In UptimeWire an incident belongs to the website check:
- It opens when three checks in a row fail, about 20 seconds apart. Where a second location or server is available, it is asked for a second opinion first.
- Its start time is the first of those failed checks.
- It closes after two successful checks.
- It keeps the duration, the failure reason, and the alerts sent.
Warnings about the SSL certificate, the domain, and DNS are separate. They do not open incidents. A website can have a certificate warning without any incident.
UptimeWire records and reports incidents. It does not offer incident notes, acknowledgement, or assignment.