---
title: "Audit your alerts in one afternoon"
description: "A short method for finding the alerts that wake people up for nothing, the ones that are missing, and the pages worth keeping."
category: Operations
author: The Ace team
published: 2026-10-19
updated: 2026-10-19
canonical: https://tryace.dev/resources/audit-your-alerts
---

# Audit your alerts in one afternoon

> A short method for finding the alerts that wake people up for nothing, the ones that are missing, and the pages worth keeping.

Most teams know their on-call rotation has too much noise. Few have looked at it as data. An afternoon with the last 30 days of pages is enough to cut the noise by a third and to find the two or three alerts that should exist and do not.

You need an export of every page or notification from the last month, with the alert name, the time it fired, who acknowledged it and how long it stayed open. Most paging tools can produce this as a spreadsheet.

## Count before you judge

Group the export by alert name and sort by count. The top of that list is almost always a surprise. A handful of alerts usually account for more than half of all pages, and a few of them have not led to an action in weeks.

Write down three numbers for each of the top twenty alerts:

- how many times it fired,
- how many times someone did something because of it,
- how often it resolved itself before anyone looked.

An alert that fires often and resolves itself is asking for a longer evaluation window or a different threshold. An alert that fires often and gets acknowledged without action is asking to be deleted or turned into a ticket.

## Ask what the page tells a person to do

For each alert you keep, answer one question: if this woke you at 3am, what would you do first? If the answer is "look at a dashboard", the alert is a symptom and the page should link to the dashboard and name the question to ask there.

A useful page has four parts:

1. what is failing, in terms a customer would notice,
2. since when,
3. the first place to look,
4. who owns the service.

A template that fits in a notification:

```text
Checkout errors above 2% for 5 minutes
Since: 14:32 UTC
First look: checkout service dashboard, error breakdown by endpoint
Owner: payments team, escalate to platform after 15 minutes
```

Alerts that describe a cause, such as high CPU, tend to page people for things that do not matter. Alerts that describe an effect, such as checkout errors above two percent for five minutes, tend to page people for things that do.

## Find what is missing

Now read the last five real incidents. For each one, note how it was detected. If a customer or a colleague noticed first, there is a gap. Write the alert that would have caught it and what threshold would have fired early enough to matter, without firing every day.

Be honest about the second half. A new alert that pages twice a week becomes the next entry in the noisy list.

## Decide with a simple rule

Put every alert into one of four groups.

| Group | What it means | What to do |
| --- | --- | --- |
| Page | Needs a human now and has a clear first step | Keep, and add the four parts above |
| Ticket | Needs a human this week | Route to a queue, not to a phone |
| Dashboard | Useful context, never urgent | Remove the alert and keep the graph |
| Delete | Has not led to action in a month | Delete it and write down why |

The aim is not fewer alerts for their own sake. It is that every page earns the interruption.

## Make it stick

Schedule the same review for the first week of every month and keep it short. Track two numbers over time: pages per on-call shift and the share of pages that led to an action. If the first falls and the second rises, the rotation is getting healthier.

Add one more habit. After every incident, ask in the review whether an alert fired, whether it was the right one, and whether it fired early enough. Each answer either changes an alert or confirms one, and the set improves with every incident instead of only growing.

When pages carry a clear first step and the evidence is one click away, whoever is on call, human or automated, starts from the right place. [Ace](/product) investigates from the same alerts, so a cleaner page set also gives it a cleaner starting point.