Skip to main content

Use paired windows without hiding missing telemetry

What This Concept Is​

A paired-window rule requires sustained evidence in a longer window and recent evidence in a shorter one. Missing observations and low traffic are distinct from a measured healthy state. These cases need explicit operational handling.

Why It Matters Here​

The original alert lab asks for fast and slow burn tied to action. Before assembling multiple rules, implement one pair precisely. A rule that turns missing collection into zero errors can conceal an outage of the monitoring path itself.

Concrete Example​

The archive accepts consecutive completed time buckets. None means collection missing; (0,0) means observed zero eligible traffic. The last short buckets and last long buckets end at the same boundary. Both burn rates must meet the threshold to alert. A long window still elevated after recovery should not keep this pair firing when the short window is below threshold.

If either selected window has a missing bucket or too few observations, status is insufficient. That is not quiet and not an instruction to suppress all operational action. A real system needs a separate collection-health signal and a low-traffic policy. The caller must retain missing intervals rather than compressing time by omitting them.

Common Confusion / Misconception​

Overlapping windows are not independent samples. Requiring both does not create a statistical confidence guarantee. A minimum observation count is a chosen policy, not proof of representativeness. A quiet result from one pair does not imply every fast/slow rule or service health check is quiet.

How To Use It​

Name bucket duration, end boundary, short/long widths, threshold and minimum traffic. Define exact threshold equality behavior. Test failure onset, sustained failure, recovery, low traffic and collector loss. Compose the final rule set with explicit boolean grouping and owner/runbook, then verify notification and recovery behavior in the actual monitoring system.

Check Yourself​

Why do long and short windows share an end? How does deleting a missing bucket change time? What does insufficient mean operationally? Why should OR replace AND only when combining separately defined rules rather than the two windows of this pair?

Mini Drill or Application​

Predict an old incident followed by recent healthy traffic, then reverse the bucket order. Insert missing collection into the long window. Record decisions before running the checker and add a separate missing-telemetry action to the original runbook.

Read This Only If Stuck​

Fundamentals of Software Architecture — fitness functions. Revisit Semester 07 evidence coverage, then the SRE alerting chapter for the broader multi-window strategy.