Glossary
Mean time to detect (MTTD)
MTTD is the average time between a problem starting and someone knowing about it, across every incident in a period.
Also called MTTD, Mean time to detection, Mean time to identify, Time to detect.
The MTTD formula is the total time to detect divided by the number of incidents. Take a month with four incidents, noticed 3, 4, 6 and 47 minutes after they began, the last one reported by a customer rather than an alert: MTTD is (3 + 4 + 6 + 47) / 4 = 15 minutes. The median of the same four is 5 minutes, and the gap between the two is the story. Three incidents were caught quickly, and one was not caught by monitoring at all.
Mean time to detect measures the gap between a problem beginning and the organisation knowing it exists. It sits at the front of every other incident metric: nothing can be acknowledged, diagnosed or fixed during time in which nobody is aware there is anything to fix. It is also called mean time to detection, and some teams say mean time to identify. The start of its clock needs care, because the moment a problem began is often only known afterwards, from logs or check history.
It is also the cheapest of these metrics to improve, because it is mostly determined by configuration rather than by engineering skill. Check interval sets the floor. Failure threshold adds a predictable multiple, and the table below does that arithmetic. What you monitor decides whether the failure is visible at all — a monitor on the homepage will not detect a broken checkout at any interval. Going from a five-minute to a one-minute interval is a settings change that removes minutes from every future incident.
The number worth watching is not the average but the source. Detection by monitoring is the intended path; detection by a customer email means the monitoring did not cover the thing that broke, and that is a coverage problem rather than a speed problem. Tracking how each incident was first noticed is more actionable than tracking how quickly.
| Check setup | On average | At worst |
|---|---|---|
| Every 5 minutes, alert after 1 failed check | 2 minutes 30 seconds | 5 minutes |
| Every 5 minutes, alert after 2 failed checks | 7 minutes 30 seconds | 10 minutes |
| Every minute, alert after 1 failed check | 30 seconds | 1 minute |
| Every minute, alert after 2 failed checks | 1 minute 30 seconds | 2 minutes |
| Every minute, alert after 3 failed checks | 2 minutes 30 seconds | 3 minutes |
Questions
What is MTTD?
MTTD stands for mean time to detect: the average time between a problem starting and someone knowing about it. It is the first clock in an incident, and it runs before time to acknowledge and time to recover can start.
How do you calculate MTTD?
For every incident in the period, take the time from the problem starting to its detection, add those up and divide by the number of incidents. Start each clock when the problem began, not when the first alert fired, or every incident monitoring caught reads as detected instantly and the number flatters you.
Is mean time to identify the same as MTTD?
Often, yes: mean time to identify and mean time to detection are both used for the same clock. Some teams use MTTI for a later step instead, the time until the cause is identified rather than the problem noticed. Say which one a number measures before comparing it with anyone else's.
What is the difference between MTTD and MTTR?
MTTD is how long a problem went unnoticed. MTTR is how long it took to restore service once it was noticed. Added together they are roughly how long users were affected, and MTTD is usually the easier of the two to shrink.
How do you reduce MTTD?
Check more often, alert after as few failed checks as your tolerance for false alarms allows, and monitor what actually breaks rather than only the homepage. Then track how each incident was first noticed: every one a customer reported first is a gap in coverage, not a slow alert.
Uptimely checks as often as every minute on every plan and alerts after 2 consecutive failed checks by default, so an outage can reach you within a few minutes of starting.
Start monitoring free →Related terms
Part of the Uptimely monitoring glossary — plain definitions of the vocabulary uptime monitoring, incident response and status pages are discussed in. Something here read wrong to you? Email support@getuptimely.com.