== Using alerts as tests that guard against future errors On Twitter, [[I said https://twitter.com/thatcks/status/1178727485556559873]]: > These days, I think of many of our alerts as tests, like code tests to > verify that bugs don't come back. If we broke something in the past > and didn't notice or couldn't easily spot what was wrong, we add an > alert (and a metric or check for it to use, if necessary). > > So we have an alert for 'can we log in with POP3' (guess what I broke > once, and surprise, GMail uses POP3 to pull email from us), and one > for 'did we forget to commit this RCS file and broke [[self-serve > device registration DHCPPortalOverview]]', and so on. (The RCS file alert is a real one; I mentioned it [[here MetricsSystemHandlesState]].) In modern programming, it's conventional that when you find a bug in your code, you usually write a test that checks for it ([[before you fix the bug ../programming/WhyRunTestsFirst]]). This test is partly to verify that you actually fixed the bug, but it's also there to guard against the bug ever coming back; after all, if you got it wrong once, you might accidentally get it wrong again in the future. You can find a lot of these tests over modern codebases, especially in tricky areas, and if you read the commit logs you can usually find people saying exactly this about the newly added tests. As sysadmins [[here https://support.cs.toronto.edu/]], how we operate our systems isn't exactly programming, but I think that some of the same principles apply. Like programmers, we're capable of breaking things or setting up something that is partially but not completely working. When that happens, we can fix it (like programmers fixing a bug) and move on, or we can recognize that if we made a mistake once, we might make the same mistake later (or a similar one that has the same effects), just like issues in programs can reappear. (If anything, I tend to think that traditional style sysadmins are more prone to re-breaking things than programmers are because we routinely rebuild our 'programs', ie our systems, due to things like operating systems and programs getting upgraded. Every new version of Ubuntu and its accompanying versions of Dovecot, Exim, Apache, and so on is a new chance to recreate old problems, and on top of that we tend to build things with complex interdependencies that we often don't fully understand or realize.) In this environment, my version of tests has become alerts. As I said in the tweets, if we broke something in the past and didn't notice, I'll add an alert for it to make sure that if we do it again, we'll find out right away this time around. Just as with the tests that programmers add, I don't expect these alerts to ever fire, and certainly not very often; if they do fire frequently, then either they're bad (just as tests can be bad) or we have a process problem, where we need to change how we operate so we stop making this particular mistake so often. This is somewhat of a divergence from the usual modern theory of alerts, which is that you should have only a few alerts and they should mostly be about things that cause people pain. However, I think it's in the broad scope of that philosophy, because as I understand it the purpose of the philosophy is to avoid alerts that aren't meaningful and useful and will just annoy people. If we broke something, telling us about it definitely isn't just annoying it; it's something we need to fix. (In an environment with sophisticated alert handling, you might want to not route these sort of alerts to people's phones and the like. We just send everything to email, and generally if we're reading email it's during working hours.)