Route an alert to a page only when it is urgent, actionable and needs human judgment. Send slower problems to a ticket queue and keep context signals on dashboards. Asking three questions of each alert sorts most of them in a minute.
The three questions
The Google SRE book gives the core test for paging. Does the alert reflect real user impact? Can the person on call take action? Could it wait until morning? Use them as a flowchart.
- User impact now and action possible: page.
- User impact soon, or action possible during working hours: ticket.
- No user impact and no action: dashboard only, or delete.
Examples
Page:
- error ratio far above target, burning budget fast
- primary database unreachable
- sign in failing for most users
- sign of an active account takeover wave
Ticket:
- error budget burning slowly over days
- certificate expiring in three weeks
- disk projected to fill in a week
- a dependency with a published fix you have not applied
Dashboard:
- CPU, memory and thread counts
- per node cache hit rates
- queue depth within normal bounds
- traffic by region
Fix the leaks
If an alert pages and the response is "looked at it, nothing to do", it fails the actionable test. Downgrade it or fix the cause. The SRE book calls rote, algorithmic responses to pages a warning sign. If the response can be written as a script, automate it.
If a ticket alert goes unanswered for weeks, it is not a ticket. Either someone owns it or it goes.
Match channel to urgency
- Phone or pager: for pages only.
- Team chat channel: for tickets and warnings someone should see today.
- Email digest: for weekly trends.
Do not send everything to chat and call that a plan. A channel with 300 alerts a day is a dashboard nobody reads.
Set a page budget
Count pages per on call shift. Pick a target the team can live with, and review the numbers monthly. The SRE book recommends reviewing page frequency over time instead of treating each page in isolation, and accepting short term costs to remove root causes.
Decide who is on the hook
Every page goes to a named rotation. Every ticket alert has an owning team. An alert with no owner is the first to be ignored.
Quick check
Can a low severity alert become a page?
Yes, if it worsens. A slow burn can escalate to a fast burn, which is why you use different thresholds for each channel.
What about alerts only some customers care about?
If a contract promises a response time, treat it as user impact for that customer and route it accordingly.
Sources
Related: alert on symptoms, not causes.
Last reviewed: 19 October 2026.
