Glossary · Monitoring

MTTD (Mean Time to Detect)

MTTD is the average time between a failure starting and the team or monitoring system detecting it, a key measure of how good alerting is.

Updated October 6, 2026

Mean Time to Detect (MTTD) is the average elapsed time from when an issue begins to when it is detected, whether by an automated alert or a human report. It is a measure of how quickly you learn something is wrong.

Why it matters

Detection is the first part of every outage's duration. Nothing can be fixed before someone knows about it. Long detection times often mean customers noticed first, which hurts trust. MTTD is shaped by check interval, number of monitoring locations, depth of checks and alert rules. It sits alongside MTTA (time to acknowledge) and MTTR (time to recover) as part of an incident's timeline.

Example

Three incidents in a month:

Incident A: started 10:00, detected 10:02 -> 2 min
Incident B: started 14:10, detected 14:11 -> 1 min
Incident C: started 22:00, detected 22:21 -> 21 min (customer email)
MTTD = (2 + 1 + 21) / 3 = 8 minutes

The outlier shows a gap in coverage worth fixing.

Common mistakes

  • Not recording when the issue actually started, so detection time cannot be calculated. Use logs and deploy times.
  • Relying on the mean alone. A few long cases can be hidden or can dominate.
  • Checking only every 10 minutes, which sets a floor on detection time.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · MonitoringAlert (Monitoring)A monitoring alert is an automatic notification sent when a check or metric crosses a defined condition, such as a site failing to respond.Glossary · MonitoringAlert DeduplicationAlert deduplication merges repeated alerts about the same underlying problem into one incident, so responders are notified once rather than hundreds of times.Glossary · MonitoringAlert FatigueAlert fatigue is when responders are exposed to so many low-value alerts that they begin to ignore, delay or silence them, including important ones.Guide · MonitoringAlert Fatigue and On-Call Basics for Small TeamsSet severity levels, escalation paths, alert thresholds and runbooks so a small team gets paged for real problems only and still sleeps through the night.8 min readGuide · MonitoringCron Job Heartbeat Monitoring to Catch Silent Failures EarlyLearn how heartbeat monitoring catches silent cron failures, with copy-ready examples for crontab, systemd, GitHub Actions, Docker, WP-Cron, Laravel and more.9 min readGuide · MonitoringDDoS Basics for Website Owners: Symptoms, Triage and ProtectionWhat a DDoS attack is, how to tell it from a legitimate traffic spike, and the basic defenses (CDN, WAF, rate limiting) plus what to tell your hosting provider.8 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.