Skip to main content
Use this guide with configured monitoring sources, permitted endpoints and agreed observation intervals. You need access to the dataset, alerts and relevant app or workflow.

​
Check the monitoring scope

Open the configured job and monitoring method. Confirm hosts or sensors, expected interval, units, thresholds, retention and permitted diagnostics. Direct ICMP or traceroute requires an approved probe integration. A custom collection job cannot inspect undeclared destinations. Monitoring does not authorise network changes.

​
Establish freshness before interpreting an alert

  1. Open the latest collection run and source observations.
  2. Compare the observation time with the expected interval.
  3. Inspect collection failures, delayed processing and coverage gaps.
  4. Distinguish an observed failed probe from a missing probe result.
A failed collector means status is unknown. It does not establish that the sensor or host is down. A successful but stale observation does not establish current health.

​
Inspect the alert’s evidence

Open the alert and follow its matched condition, grouping and cited observations. Check the threshold’s unit and the rule version. Compare related measurements before accepting an agent’s explanation. A change in latency or reachability is a measurement. Its proposed cause is an interpretation. For track or radar monitoring, inspect the coordinate reference, route/corridor, tolerances, observation time and positional uncertainty. Uncertain identity or late observations cannot establish a confirmed area transition.

​
Track attention and recovery separately

Use the alert’s configured acknowledgement, reminder and escalation controls. Confirm the current responsible recipient and recorded state. Acknowledgement records that somebody saw the alert. Recovery requires a fresh observation satisfying the recovery condition. Missing follow-up input leaves recovery unconfirmed. Repeated matches can update one alert group. Check its last-seen time and count before interpreting repeated notifications as independent faults.

​
Inspect any follow-up workflow

A condition watch raises an alert. A workflow starts only through its separately configured trigger or declared action. Open that run and inspect its inputs, decisions and outputs. A diagnostic result does not authorise reconfiguration. A report requiring publication follows its own review route. Finish by recording the measured change, evidence freshness, proposed cause and confirmed or unresolved recovery. Use Configure a condition watch for watch setup.