Incidents

An Incident is a confirmed failure of one Check on a Monitor. It opens once the failure is confirmed, as How a failure is confirmed explains, and it lasts until the Check gets through again or somebody stops it.

An Incident belongs to one Check. When two Checks of one Monitor fail, they are two Incidents.
A Check has at most one open Incident at a time.
Only Incidents on the uptime Check count as downtime. An Incident on the certificate or domain Check tells you something is wrong, but your uptime is not touched.

The Incident card

While an Incident is open, its card sits at the top of the Monitor’s page. From top to bottom, it says:

Down, and how long it has been down.
Where the request stopped, and the one next step, when we know one.
How many locations agree, as “2 of 3 locations agree”, and who is on it once somebody has acknowledged it.

Under them are its buttons. Acknowledge tells everyone you are on it. Copy report copies a report you can send to your host. Open Incident opens the Monitor’s Events tab on its Incidents, where the full story is.

Once the Incident has ended, the card stays, muted, and says when it ended: “Recovered at” a time in UTC when it got through again, or “Ended at” for any other ending. It leaves the page by itself, for everyone, 7 days after the Incident ended, and nothing replaces it until the next one.

The Events tab

The Events tab lists everything that has happened to the Monitor, newest first: each Incident and each Regional outage. Choose All, Incidents or Regional outages to see one kind. Show earlier reads older ones, back to the first.

Each row says what happened, on which Check, how it ended, how long it lasted and when. It also says what it cost you: “counted as downtime” for an Incident on the uptime Check, and “uptime unaffected” for everything else.

Expand a row to see what each location saw, and How uup decided: each step from the first failed run to the end, with its time.

How an Incident ends

An Incident ends in one of these ways. Each one shows on its row as a badge:

recovered: It got through again, and most of the locations that answered agree. You get a recovery message.
manually resolved: Somebody pressed Resolve. You get a message saying who, and we go on checking.
Check turned off: Somebody turned the Check off while it was failing. You get a message saying so, and the Check is not checked until it is turned on again.
Monitor paused: Somebody paused the Monitor while it was failing. You get a message saying so, and it is not checked until it is resumed.
suspended: Your Plan no longer covers this Monitor. Nothing is sent, because you were told when the Plan changed.
retracted: We took it back, because it should never have opened. You get a correction in place of a recovery message.

For the endings a person causes, Check turned off, Monitor paused and manually resolved, the message is sent only when the Incident’s own alert was sent. When nobody was told it began, nobody is told it ended.

Every ending but retracted keeps the downtime before it: the Incident was real while it lasted. A retracted one leaves your uptime, as Reported in error explains.

Resolving by hand

On the Events tab, an open Incident has Resolve. Only the owner and admins can resolve an Incident.

Resolving means “look at it again”, not “it is fine”. The Incident ends at once, as manually resolved, and the Check starts again from Pending. When it still fails, a new Incident opens.

Resolving cannot be undone, so it is on the Events tab and not on the card.

Dismissing a card

After an Incident has ended, Dismiss on its card takes the card off the Monitor’s page, for you alone. Anybody who can open the Project can dismiss a card. Everyone else still sees it until they dismiss it too, and it reads the same on every device you use.

Dismissing changes nothing in the record. The Incident stays on the Events tab, in your uptime and on your Status page. An open Incident cannot be dismissed, and the next Incident brings the card back.

Regional outages says what happens when only one location cannot reach your address.