# Monitoring vs Alerting Checklist (July 2026)

Use this before adding another CloudWatch alarm or pager route. Pair with Application Signals SLOs and Synthetics canaries.

## Definitions

| Term | Means | Example |
| --- | --- | --- |
| Monitoring | Continuous collection + visibility | Dashboards, Logs Insights, Application Signals service map |
| Alerting | Human-interrupting signal with ownership | SNS → PagerDuty/Opsgenie on SLO burn or canary fail |
| SLI | Service level indicator (measurement) | Successful request ratio, canary success rate |
| SLO | Internal target on an SLI | 99.9% successful requests / 30 days |
| Page | Wake someone now | Only when users are (or will be) impacted |

## Alarm inventory (fill per production service)

| Alarm / SLO | Signal type (infra / app / journey) | Pages? (Y/N) | Owner | Runbook URL | Noise last 30d (#) | Keep / Retune / Delete |
| --- | --- | --- | --- | --- | --- | --- |
| | | | | | | |
| | | | | | | |
| | | | | | | |

## Decision rules

1. **No page without a runbook** — if nobody can act in 15 minutes, make it a ticket or dashboard only.
2. **Prefer SLO burn over raw CPU** — CPU at 80% is monitoring; error-budget burn is alerting.
3. **One journey canary per critical path** — alert on canary fail + Application Signals SLI, not on every container restart.
4. **Composite before flood** — wrap related metric alarms in a composite so one incident = one page.
5. **Delete or mute** any alarm that fired >5 times in 30 days with zero actionable outcome.

## First-party noise budget (worksheet)

| Metric | Your value |
| --- | --- |
| Production pages last 30 days | |
| Pages that led to a change / fix | |
| Actionable page rate (fixes ÷ pages) | |
| Target actionable rate | ≥ 70% |

If actionable rate < 50%, stop adding alarms — retune or delete first.

## Application Signals wiring

- [ ] Transaction Search enabled
- [ ] SLOs defined for ≤ 3 critical journeys (not every microservice)
- [ ] Service Events reviewed after deploys (Jul 2026+)
- [ ] Synthetics canaries linked to the same journeys as SLOs
- [ ] Instrumentation is ADOT / Application Signals — not net-new X-Ray SDK (maintenance mode since 2026-02-25)

## Sources

- CloudWatch alarms + Application Signals docs
- FactualMinds post: monitoring vs alerting (2026-07-22)