Monitoring

The checks are chosen by asking what the business actually depends on. Typically: the domain resolving, the certificate valid and not near expiry, the site returning a page, not an error, mail to the published address arriving, and the form producing a message a human receives.

That last one is an end-to-end check, not a component check, and it is the most valuable of the set. Every individual piece can report success while the message lands in a spam folder nobody opens, which is a failure no server-side metric will ever show.

Certificate expiry is watched with enough margin to act. Automatic renewal is normal and it fails occasionally, always silently, and the first symptom is a browser warning that makes a site look compromised, not merely misconfigured.

Domain expiry is watched too, and it is the one nobody thinks of. The renewal notice goes to whichever address was used at registration, which is frequently a former employee or a personal account nobody checks, and the outage is total.

Alerts go to a person, not to a dashboard somebody is expected to visit. A dashboard reports state to whoever is already looking; the entire purpose of an alert is to reach somebody who is not.

Alert volume is treated as a property to be managed, not a side effect. A channel producing routine noise gets muted, and a muted channel is worse than no monitoring at all, because everybody believes coverage exists.

Checks run from outside the infrastructure being checked. A monitor hosted alongside the thing it watches goes down with it, and reports nothing at precisely the moment its report is the only thing anyone wants.

What is not monitored is written down as plainly as what is. A stated gap is something a business can decide to close; an assumed coverage that does not exist is discovered during the incident it should have caught.