A university collected one hour of application metrics this afternoon and wants alerting turned on before tonight's peak. What should the team have in place before a spike is treated as an incident?
Select an answer to reveal the explanation.
Short Explanation
One photograph of a campus quad is not a picture of the whole semester. You build a baseline of the university's normal behavior before a spike from this single hour becomes an incident. The trap is alerting on that first sample, lifting the threshold until the chart is quiet, or swapping the metric for a ticket count.
Full Explanation
One afternoon hour shows a slice of the university's day and does not show how the application behaves across ordinary class days, evenings, and the quieter parts of the week. Before a spike is an incident, the team needs a baseline of that normal behavior to compare against, and this hour cannot supply it yet. Turning on an alert from the first sample in the hour treats an unknown point as a deviation when there is no picture of normal to deviate from. Raising the threshold until the one-hour chart stays quiet manufactures silence from a sample that is too short to represent a class day, and tonight's real peak would be judged against that silence. Replacing the application metric with a help-desk ticket count changes the subject from experience to how many people called, which is not a baseline of the metric they want to watch. Exam caveat: alerting starts after normal behavior is known for the cycles you care about, and a single quiet hour is not that knowledge. Operational check: keep collecting through ordinary class days, mark the usual range those days show, and only then decide whether a new spike sits outside that range.