Alerting & Incidents
Root cause analysis
Every incident explains exactly what failed and why.
When an incident fires, you shouldn't have to guess what went wrong. WatchFor's Root Cause Analysis lays it out.
What you see
- The failing condition — which rule matched, and the value that tripped it (e.g. "status code 503", "response time 4.2s", "expires in 9 days").
- Confirming probes — the actual checks, from which locations, that confirmed the failure, with their timing and results.
- Plain-language diagnosis — raw probe errors translated into something readable, not a cryptic stack of codes.
- The rule in effect — the exact alert rule (and its version) that was active when the incident started.
Why the rule version matters
If you change a rule after an incident began, the analysis still shows the rule that was in effect when it fired — with a clear note that the rule has since changed. Your diagnostics never get rewritten under you.
Type-aware details
Root cause is tailored per monitor type:
- HTTP — status, body-match keyword, per-stage timing.
- Ping — RTT and packet loss (not a misleading duration).
- SSL — which validity check failed and the days remaining.
- DNS — expected vs. actual records.
Latency and durations are shown in real units (ms / s), and charts offer a logarithmic view so a single huge spike doesn't flatten everything else.