Alert fatigue

Alert fatigue, also called alarm fatigue, is what happens to people who are alerted so often, for so little, that they stop reacting to alerts at all. The term comes from hospitals, where staff surrounded by monitors that beep constantly learn to tune them out. On-call engineers show the same effect: when most pages turn out not to matter, the page that does matter is acknowledged late, or not at all.

Alert fatigue is the predictable human response to being interrupted too often for things that turn out not to matter. It does not present as a decision to ignore alerts; it presents as slower acknowledgement, as muting a noisy channel during a busy afternoon, as assuming the new page is the same as the last four. Every one of those is reasonable in isolation, and together they mean the alert that mattered was seen late.

The noise comes from a few reliable sources. Alerts on causes rather than symptoms — CPU, memory, disk — fire constantly and mostly describe a system working as designed. Duplicate alerts from several tools describe one problem several times. Alerts nobody can act on at 3am train people that being woken is not necessarily meaningful. And false positives corrode faster than anything else, because they teach that the signal itself is unreliable.

What reduces it is mostly deletion. Every alert should have a documented action, and one that does not is a dashboard entry rather than a page. Alert on customer-visible symptoms and let the cause alerts be diagnostics you look at once you are awake. Group related alerts so one incident is one interruption. Route by severity so that only the things worth waking someone for wake anyone. And review what actually paged the team each week — the list is usually shorter and stranger than anyone expects.