False positive alert
A false positive alert reports a failure that did not affect users, such as a single timed-out check caused by the network between the monitor and the server.
Common causes are a single slow or dropped request, a problem on the monitoring location's network, a timeout set close to normal response times, or a keyword that changed with a page update.
False positives are costly because they teach people to ignore alerts. The fix is to require confirmation before alerting, not to check less often: more frequent checks with a threshold of several failures in a row find real outages just as fast and ignore one-off blips.
In OpenUptime
In OpenUptime a monitor goes down only after a set number of failed checks in a row (3 by default). With several regions, a run fails only when a majority of them fail, unless you set a different count.
How multi-region verdicts work →
Questions
How many failed checks should trigger an alert?
Two or three in a row is common. Multiply by the check interval to see the delay: three failures at one-minute checks alert after about three minutes.
Do multiple regions reduce false positives?
Yes. A problem on one region's network fails only that region, so requiring a majority keeps it from alerting while a real outage fails them all.
Related terms
Monitor it with OpenUptime
Checks from one or several regions, alerts to the tools you use, and a status page for your customers. Free to start, open source under the MIT license.
误报（False positive alert）
误报是指告警报告了一个并未影响用户的故障，例如监控与服务器之间的网络问题导致某一次检查超时。
常见原因包括：某一次请求慢或丢失、监控所在位置的网络问题、超时时间设得太接近正常响应时间，或者页面更新后关键词变了。
误报的代价很高，因为它会让人习惯性地忽略告警。解决办法是告警前要求确认，而不是降低检查频率：检查更频繁、同时要求连续多次失败，既能同样快地发现真故障，又能忽略偶发抖动。
在 OpenUptime 中
在 OpenUptime 中，只有连续失败达到设定次数（默认 3 次），监控才会判定为宕机。从多个区域检查时，只有多数区域失败才判定本轮失败，除非你设置了不同的数量。
常见问题
连续失败几次再告警合适？
连续两到三次比较常见。乘以检查间隔就是告警延迟：每分钟检查、连续失败三次，大约三分钟后告警。
多区域检查能减少误报吗？
能。某个区域的网络问题只会让这个区域失败，要求多数区域失败就不会因此告警；而真正的故障会让所有区域都失败。