How much of your alerting is just noise? A five minute audit

Alert fatigue is one of the most expensive problems in IT operations, and almost nobody has it on a balance sheet. It shows up instead as slower incidents, missed warnings, and good engineers quietly learning to ignore the very system meant to protect the business. Splunk's research found 73% of organisations have suffered outages caused by ignored or suppressed alerts, which is alert fatigue with a price attached.  

Here is a quick audit. Answer honestly; the discomfort is the point.  

One. What proportion of yesterday's alerts were actionable. Not interesting, actionable, meaning someone needed to do something. A useful benchmark from Splunk: if fewer than roughly 60% of your alerts are actionable, there is room to improve. Many teams, asked to guess, land well below that.  

Two. How many alerts fire on a normal day. If the number is high enough that no human reads them all, then in practice they are not alerts. They are background noise with notifications attached.  

Three. How often does one real issue generate a flood. When a single fault trips ten tools and pages ten times, that is not ten problems. It is one problem and nine distractions, and a sign your signals are not correlated.  

Four. Can you tell customer-impacting from cosmetic at a glance. If separating the checkout is down from a non-critical batch job ran slow takes investigation, your alerts are not carrying the context that would let you prioritise instantly.  

Five. Do the same alerts recur without ever being resolved. Recurring noise that everyone has learned to swipe away is the clearest symptom of a system optimised for volume over meaning.  

If several of those stung, you are not unusual, you are normal. And the answer is not to turn everything off and hope. It is to change what alerting is for.  

Good alerting prioritises by business impact, so the signal that is actually hurting customers rises to the top while cosmetic noise drops down. It correlates related signals, so ten symptoms of one incident arrive as one intelligent alert rather than ten separate pages. And it increasingly uses machine learning to suppress predictable noise and surface the genuine anomaly, the thing you did not already know to look for.  

The goal was never fewer alerts as a vanity metric. Plenty of teams could halve their alert count tomorrow and be no better off. The goal is alerts your team trusts enough to act on the moment they arrive, because the day you can trust the alert is the day the noise stops costing you.  

If the audit raised a few uncomfortable answers, an Observability Discovery from VCG can show how much of your alert volume is noise, and how to surface the signals that matter.  

→ Book a free Observability Discovery | info@vcg.group | 0161 406 1820 

Exploring observability further? Join us in London in September 2026 - an event for technology leaders on how unified observability drives operational resilience and commercial performance.

Register for the event