Alert Fatigue and Anti-Patterns

Alert fatigue is what happens when the interruption system stops protecting attention and starts consuming it. Responders receive too many pages, too many of them are duplicates or false positives, and the trust relationship between humans and the alerting system begins to break. Once that trust erodes, even good alerts are more likely to be doubted or delayed.

The anti-patterns are familiar:

• flapping alerts that fire and resolve repeatedly
• duplicate pages from several layers for one incident
• pages with no actionability
• stale alerts that no longer reflect real service behavior
• escalating everything to high severity by default

These are not minor annoyances. They actively weaken incident response by teaching people that interruption does not reliably signal importance.

    flowchart TD
	    A["Too many weak alerts"] --> B["Responder distrust"]
	    B --> C["Slower acknowledgement"]
	    C --> D["Higher incident risk"]
	    A --> E["Burnout and poor tuning discipline"]

Fatigue Usually Comes From Design, Not From Volume Alone

Teams sometimes say they have “too many alerts” when the deeper problem is lower quality:

• poor thresholds
• noisy cause paging
• lack of deduplication
• missing suppression during known maintenance
• no ownership review for old alerts

Reducing page count helps, but only if it is paired with better alert design.

1fatigue_controls:
2  deduplication: true
3  flapping_suppression: true
4  maintenance_silences: true
5  review_cadence: monthly
6  questions:
7    - "Did this alert represent real impact?"
8    - "Was the responder able to act?"
9    - "Did another alert already cover this condition?"

Every Alert Should Be Reviewable

One of the strongest practices is alert review after incidents and after false pages. Each page should be treated as evidence about the alerting system itself:

• was the interruption justified
• was severity correct
• did the routing make sense
• what should change to improve future signal quality

If those questions are never asked, fatigue becomes structural.

Design Review Question

If responders receive several high-severity pages for the same underlying incident and learn to ignore some of them, what anti-pattern is most likely present?

The stronger answer is duplicate or poorly deduplicated alerting. The system is overreporting one event as many interruptions and eroding trust in the process.

Quiz Time