What counts as critical

A critical alert is one that, on its own, would justify a call outside business hours. Disk full on a production server counts. A print spooler restart does not. De-duplicate repeats from the same device within an hour. Write the rule down; a quarter with a tuned threshold is not comparable to one without unless the client knows the threshold moved.

Presenting the trend

Four last period, two this period, is a halving and a good sentence. Forty to thirty-eight is noise and belongs in the source row, not the findings. Pick the three metrics that moved most; if critical alerts did not move, it is not a finding this quarter.

When the count rises, say where from. Two-thirds of criticals from one aging host is a hardware decision. Criticals spread evenly across the estate is a monitoring-tuning decision, and that one is yours to own, not theirs to fund.

The decision

Ask for the thing that removes the alert source: the replacement, the upgrade, the retirement. Put a cost and a date on it. If the client declines, write that down on the page too; next quarter's alert count will reference the decision they made.

  • Approve the replacement or the upgrade that removes the top alert source.
  • Agree the critical threshold for next period so the numbers stay comparable.

One line, one source

The alert count is a good example of a metric that needs its source row visible: clients ask how it was counted, and the honest answer is a definition plus two numbers. A brief that keeps the definition and the two periods beside the claim answers that in the room instead of in a follow-up email. Sourcerow generates that page from the ten-field template; the threshold rule, and the judgment about which host to replace first, are yours.

A worked example

A twelve-server manufacturing client logged 61 critical alerts last quarter and 38 this quarter after de-duplication. Twenty-six of the 38 came from one 2016-era host whose RAID controller throws a predictive-failure warning every few nights. The rest are spread across the estate with no pattern.

The finding is that criticals fell by a third and two-thirds of what remains is one machine. The decision requested is to replace that host before its warranty lapses in November, with a quote attached in the appendix. The monitoring tuning for the remaining twelve is listed as an MSP task, not a client decision, because the client should not be asked to fund your thresholds. Next quarter, if the count drops to the low teens, the page can say why in one clause.