Comparisons
Two tools, two questions. Neither column wins — what decides is which question you actually have in front of you.
Cause-based alerts vs Symptom-based alerts
Alerting on CPU tells you a machine is busy. Alerting on the SLI tells you users are suffering. Cause alerts are useful as diagnostics; as pages they generate noise and miss the failures nobody predicted.
Investigation and dashboards; a small number of genuinely predictive precursors
Failure modes you did not anticipate — which is most of them
Grows without bound; every new resource invites another threshold
"Is this machine busy?"
Paging a human: user-visible failure and latency, tied to an SLO
Which component to fix; a symptom alert starts the investigation, it does not finish it
Requires defining an SLI honestly, which is the actual work
"Are users having a bad time right now?"
| Dimension | Cause-based alerts | Symptom-based alerts |
|---|---|---|
| Fires for unknown failures | No | Yes |
| False positives | Many — busy is not broken | Few, if the SLI is well chosen |
| Actionable | Sometimes | Always, by construction |