False positive (monitoring)
A false positive is an alert for an outage that isn't real — often a transient network blip from one location.
A false positive in monitoring is an alert that fires when nothing is actually wrong — a brief network hiccup between a single probe and your service, a momentary DNS wobble, or a one-off timeout that resolves on its own. The service was fine for users, but the monitor reported it as down.
Why it matters: false positives quietly erode the entire value of alerting. Page people for non-incidents and they begin to distrust and ignore alerts, so acknowledgement time climbs and a real outage gets the same shrug as the noise. The cost isn't just the interrupted sleep — it's the slower response to the incident that actually matters.
A common misconception is that the cure is to slow down or loosen checks until the noise stops. That trades false positives for false negatives — missed real outages — and inflates detection time. The better approach is confirmation: require multiple independent signals to agree before declaring an outage, so you stay both fast and trustworthy.
The standard technique is multi-location quorum combined with a consecutive-failure threshold: a service is only marked down when several regions agree it's failing, or when failures repeat across consecutive checks. PingInsight confirms outages with multi-region quorum and a consecutive-failure threshold so a blip in one place doesn't page anyone, while a genuine outage is still caught quickly.
Frequently asked questions
- What causes false positives in monitoring?
- Usually transient conditions between a single probe and the service: brief network congestion, a momentary DNS or routing issue, or a one-off timeout. The service is fine for users, but one vantage point saw a blip.
- How do you reduce false positives without missing real outages?
- Use confirmation rather than slower checks. Requiring multiple regions to agree (quorum) and/or several consecutive failures before alerting filters out blips while still catching genuine outages quickly.
- Why are false positives harmful?
- They cause alert fatigue. When responders learn that most pages are noise, they respond slower to all of them — including the real incident — which raises acknowledgement and recovery time.
Start monitoring in under a minute
Free forever, no credit card. Upgrade when you need finer intervals.