--- title: Your uptime monitor keeps crying wolf description: An 'offline' alert when the site isn't offline trains you to ignore alerts — right up until a real outage. Why single-location checks cause false alarms, and how multi-region confirmation, retries and flapping suppression fix it. source: https://pingvera.com/blog/false-downtime-alerts.html --- # Your uptime monitor keeps crying wolf Here's a pattern anyone who's run monitoring knows too well: the phone buzzes — _"site is DOWN"_ — you scramble to a laptop, open the site, and it loads instantly. Fine. Green. Nothing wrong. It happens again next week. And the week after. Eventually you do the most dangerous thing in all of monitoring: **you start ignoring the alerts.** Then one day the site really is down, the alert looks exactly like all the false ones, and you find out from the client. ## Why a monitor "sees" downtime that isn't there The usual culprit isn't your site — it's the fact that the monitor checks from **one place**. A single probe has a single path to your server, and that path has its own weather: a routing blip at some intermediate hop, brief packet loss, a slow DNS resolver, or the probe's own host being momentarily overloaded. From that one vantage point, a two-second network hiccup is indistinguishable from the server being on fire. Meanwhile every real visitor — on different networks, in different cities — loads the site perfectly. The outage existed only on the wire between your monitor and your site. But the alert already went out. ## The workarounds people reach for (and why they're half-fixes) - **"Just retry before alerting."** Helps with a one-off blip, but if the network path itself is degraded for a minute, every retry from the same probe fails too. Same blind spot, three times. - **"Run two monitors and trust it only if both fire."** This is actually the right instinct — you're asking for a second opinion. But now you maintain two systems, reconcile two dashboards, and hope they don't both sit in the same network neighbourhood. - **"Raise the failure threshold."** Wait for five failures instead of one and you cut noise — but you also delay the real alert, and a persistently bad path still trips all five. ## The actual fix: ask more than one place A false "down" is, almost by definition, a _local_ problem — it's true from one probe and false from everywhere else. So the reliable test isn't "did a check fail?" but **"do several independent locations agree the site is down?"** That's **multi-region confirmation**, sometimes called a quorum. A check runs from probes in different places; an incident only opens when enough of them agree the site is genuinely unreachable. If the site answers from other regions, the monitor concludes — correctly — that this is a network issue between one probe and the target, not an outage, and stays quiet. You get the second opinion automatically, without running a second system. Layer two more things on top and the noise essentially disappears: - **Confirmation before the alarm** — require a few consecutive failures, so a single hiccup never pages you, while a real outage still alerts within seconds. - **Flapping suppression** — when a site rapidly bounces up/down/up, collapse it into one calm signal instead of a dozen buzzes. ## Why this matters more than it sounds Alert fatigue isn't a minor annoyance — it's how outages get missed. The whole value of a monitor is that when it speaks, you move. Every false alarm spends a little of that trust, and once it's gone, the tool is worse than useless: it's a pager you've trained yourself to swipe away. Cutting false alarms isn't about comfort. It's about keeping the one alert that matters believable. ## FAQ **Why does my uptime monitor say the site is down when it's actually up?** Almost always because it checks from a single location. A transient network problem between that one probe and your site looks identical to a real outage from that vantage point. Real visitors elsewhere never notice, but the monitor pages you anyway. **How do I stop false downtime alerts?** Confirm from multiple regions and alert only when a quorum agrees the site is down; require a few consecutive failures before opening an incident; and suppress flapping. The first is the big one — most false alarms are a single probe's local network problem, not the site's. **Isn't alerting on the first failure safer?** It feels safer but backfires: if most alerts are false, you stop reading them and miss the real one. A short confirmation delay costs almost nothing on a real outage and removes the noise that trains you to ignore the pager. Read also: [Uptime Kuma is great — but it only pings](https://pingvera.com/blog/uptime-kuma-only-pings.html) and [Your client's site went down: know before they call](https://pingvera.com/blog/client-website-down.html).