How checks and incidents work

Every monitor has a schedule. At each tick a check runs from the regions you chose and the result is recorded: did it answer, how fast, and what went wrong if it did not.

Confirming a failure

When a check fails, we check again before calling it down. If you use several regions, a monitor is only called down when most of them agree, so a bad route in one place does not raise a false alarm.

Incidents

A confirmed failure opens an incident. The incident records when it started, the cause we saw, every alert that was sent, and who handled it. It closes when the monitor is healthy again, and the duration is added to your downtime figures.

• Ongoing means the problem is still there.
• Resolved means it has ended.
• You can acknowledge an incident so your team knows someone is on it.

Checked faster while down

While a monitor is down it is checked more often than usual (down to a minute, or your plan's fastest interval if that is shorter), so you see recovery quickly. You can turn this off in the monitor's How often section.

Slow responses and expiry

Besides down, a monitor can open incidents for a slow response, a certificate about to expire, or a domain about to expire. Each kind can have its own response rules, see Managed Responses.