Docs / Operations

Monitoring alerts explained

Every alert we send, what it means, who receives it and what happens next.

Last reviewed 6 Nov 20266 min read

Every alert we send has a name, a severity and a next step. This page lists them all, so you know which ones need you and which ones we handle ourselves.

How checks work

  • Public endpoints are checked every minute from two locations in the EU.
  • An endpoint is marked down only after three failed checks in a row from both locations — roughly three minutes. A single network blip doesn’t wake anyone up.
  • Agents on your servers report CPU, memory, disk and the state of key services every minute. An agent that goes silent is an alert in itself.
  • When an endpoint recovers, the recovery message includes the total downtime, so nobody has to work it out from timestamps.

Severity levels

SeverityMeaningWho is notified
CriticalCustomers are affected now, or data is at risk.On-call engineer and your on-call contact — phone and push, then email.
WarningWill become critical if nobody acts.Your Quiet Harbor engineer, during business hours.
InfoSomething changed; no action needed.Collected in the weekly health summary.

Alert reference

AlertSeverityWhat it means
Endpoint downCriticalThree failed checks in a row from both locations. We start investigating within the response time in your SLA.
Endpoint recoveredInfoThe endpoint answers again. The message includes total downtime; a short note on the cause follows when we know it.
Agent silentWarning → CriticalNo report from a server for 5 minutes; critical after 15. We check whether the server or just the agent is down.
Disk above 90%WarningSent once and cleared when usage drops below 85%, so it never repeats every minute. We find what grew and clean up or propose a resize.
Backup staleCriticalNo successful backup in 26 hours, or a backup much smaller than the previous one. See the backup policy.
Certificate expiringWarning → CriticalA TLS certificate expires in 14 days; critical at 3 days. Renewal is automatic, so this alert means automation failed.
Renewal dueInfo → WarningA domain or hosting plan renews in 14 days; warning at 3 days. Addressed to whoever holds the payment method.
Watchdog heartbeatInfoA weekly “still alive” message from the backup watchdog.

Why a heartbeat? A watchdog that has silently died looks exactly like one with nothing to report. If Monday’s heartbeat doesn’t arrive, tell us.

Muting alerts during maintenance

Tell your engineer about planned work at least one business day ahead, with a start time and expected duration. During a declared window, alerts are still recorded but don’t page anyone. The window closes automatically, so a forgotten mute never hides a real outage.

Why you may get fewer alerts than before

Most teams come to us with more alerts than they can read. We remove alerts that never led to action, merge duplicates and only page for things a person needs to fix now. Everything else goes into the weekly summary. If you miss an alert you used to rely on, ask — it is usually still recorded, just not sent to your phone.