How do you design actionable alerts to reduce noise?

Deep dive

Actionable alerts are about impact and clarity:

• Alert on SLO burn-rate, not every error.
• Use multi-window (fast + slow) to catch spikes and sustained issues.
• Define severity levels with clear response expectations.
• Add context: links to dashboards, traces, and recent deploys.

Examples

Burn-rate concept:

If error budget burn-rate > 14x for 5m -> page
If burn-rate > 2x for 1h -> ticket

Common pitfalls

• Alerting on CPU alone (symptom, not impact).
• Too many low-signal alerts without deduplication.
• No runbook, so responders waste time.

Interview follow-ups

• What’s your threshold for paging at night?
• How do you tune alerts after incidents?
• How do you prevent alert fatigue?