The Difference Between Page-Worthy and Ticket-Worthy Alerts
If everything is a page, nothing is a page. The discipline is to make ticket-tier the default and earn the page-tier promotion.
The four-question filter
1. Will user impact occur if not addressed within 15 minutes? 2. Is there a clear runbook the on-call can execute? 3. Is the runbook safe to execute at 3am? 4. Is the alert high-signal (false-positive rate <5%)?
All four yes → page. Anything no → ticket.
Why ticket-tier matters
- Most alerts are useful but not urgent. Capacity trends, slow leaks, expiring certs 30 days out. Tickets handle these in business hours; pages waste oncall.
- Teams with strong ticket-tier discipline have 60-80% fewer pages without missing real incidents.
The migration playbook
Audit existing alerts; classify against the four questions. Anything failing question 1 or 4 becomes ticket-tier immediately. Anything failing 2 or 3 needs runbook work before promotion to page-tier.
Plan a quarter for the migration; it is satisfying work but not glamorous.
Severity drift
Severity drifts up over time as ‘just in case’ promotions accumulate. Quarterly review demotes the ones that no longer need page-tier.
The metric: pages-per-shift trending down while incidents-detected stays flat. The math has worked.
Antipatterns
- Page-tier as the default. Promotes drift; demotion never happens.
- Ticket-tier in a queue nobody reads. Tickets need an SLA too, just longer.
- One-time migration. Drift returns without quarterly discipline.
What to do this week
Three moves. (1) Apply this pattern to your noisiest alert. (2) Measure pages-per-shift before/after for one week. (3) Schedule the quarterly review so the discipline survives team turnover.