False Positive (Monitoring)

A false positive in monitoring is an alert reporting a problem that does not exist. The check failed, but the service was fine for users. Typical causes are a brief network blip between the monitoring node and the site, a probe IP being rate-limited by a firewall or WAF, and a timeout that is too tight.

Why it matters

False positives waste time and erode trust. Repeated ones lead to alert fatigue, and responders start treating real alerts as noise. They also create misleading downtime statistics that can affect SLA reports.

Example

A single probe in one region times out after 10 seconds, and an alert fires. Two other regions loaded the page normally. Requiring failures from at least two locations, plus a retry 30 seconds later, would have prevented the alert. The check configuration might read:

interval: 60s
retries: 2
confirm_from: 2 locations
timeout: 15s

Common mistakes

• Alerting on the first failure with no confirmation.
• Forgetting to allow monitoring IP ranges through the firewall or bot protection.
• Comparing only one metric, instead of checking from several vantage points.

Related

• False negative
• Alert fatigue
• Flapping
• Guide: How to reduce false alerts

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.