Reporting · 12 min
Reporting & Operational Health
What questions should reporting answer for an administrator?
Organised around operational questions rather than a catalogue of reports. Each question follows the same pattern: Signal, Possible Cause, Admin Action.
Signal
High alert volume, repeated duplicate alerts, one integration dominating the queue
Possible Cause
- • An integration sending every event rather than actionable conditions
- • No grouping for related signals
- • Missing alert policies to suppress known noise
- • Large numbers of alerts closed without action
Admin Action
Review integrations, alert grouping and alert policies before touching escalation.
Signal
Alerts frequently reassigned, or teams reporting alerts that are not theirs
Possible Cause
- • Routing conditions that no longer match reality
- • Team ownership boundaries that have drifted
- • Responders added ad hoc instead of through ownership
- • Integration configuration sending everything to one team
- • Missing or incorrect service ownership
Admin Action
Review routing, team ownership, responders, integration configuration and service ownership.
Signal
High escalation rate
Possible Cause
- • Schedule coverage problem
- • Primary responder not acknowledging
- • Incorrect notification configuration
- • Escalation timing too aggressive for the work
- • Incorrect team ownership
Admin Action
Trace the response path in order rather than lengthening escalation timers.
Signal
Acknowledgement and resolution trends moving in the wrong direction
Possible Cause
- • Responders triaging noise before reaching real signals
- • Unclear ownership at the moment of alerting
- • Coordination overhead in the incident process
Admin Action
Read response measures together, not in isolation.
Common measures
- Mean Time to Acknowledge
- Mean Time to Resolve / Close
- Alert response trends
- Incident resolution trends
Signal
Repeated incidents concentrated against one service
Possible Cause
- • Underlying reliability problem
- • Recurring change-related impact
- • Capacity constraints
- • Unclear service ownership allowing issues to persist
Admin Action
Use service-level incident concentration as an input to reliability and problem management.
What to do with the answer
- Reliability improvement
- Problem management
- Capacity planning
- Service ownership discussions
- Prioritisation of engineering improvements
Reporting principle
Reporting principle
Reporting should help administrators identify weaknesses in the operating model.
Read each signal as a pointer to a part of the model that needs attention.
- High escalation rateReview schedules and response design
- Thousands of similar alertsReview integration and grouping
- Repeated incidents against one serviceInvestigate reliability and problem-management opportunities
- Alerts frequently reassignedReview routing and ownership