OQ8

Monitoring existed before we arrived, and that was the problem: enough alerts arrived each morning that the team had stopped reading them. An alert nobody reads is worse than no alert, because it looks like coverage.

Tuning before extending

The first phase added no new coverage at all. We reviewed every existing threshold against what the team would genuinely act on at three in the morning, and removed or raised the rest.

Then the gaps

With the noise down, the real gaps were visible. Plant network devices and several application tiers had no coverage, and their failures had been surfacing as user complaints rather than alerts.

Where they are now

Alert volume is a fraction of what it was and each one has an owner and a runbook entry. Coverage extends across both networks, and escalation reaches our engineers in Muscat when it needs to.