Adaptive Latency Baselines

Warden learns what normal latency looks like for each monitor. This detects a slow service while it is still returning successful responses without forcing every target to share one millisecond threshold.

How the baseline is learned

For every active monitor, Warden calculates two percentiles from successful checks:

• P50 is typical latency.
• P95 includes normal slow responses while excluding the most unusual tail.

Failed checks do not contribute because their duration often describes a timeout rather than healthy performance. By default Warden uses seven days, requires 200 successful checks and recomputes hourly. Baselines persist across restarts.

When a monitor becomes degraded

The default adaptive threshold is:

max(P95 × 1.5, P95 + 100 ms)

If latency remains above the threshold for the configured confirmation and sustained-alert windows, Warden opens a degraded outage. The monitor is still reachable; this is separate from down.

Which threshold wins

Warden resolves thresholds in this order:

1. an explicit per-monitor latency threshold;
2. the learned baseline after enough samples;
3. the global fixed threshold while learning.

After moving Warden

Latency includes the path from Warden to the target. Moving the instance to another network, VPN or region can shift every series. Warden preserves history and baselines, so allow enough successful samples to represent the new observer location before treating the new baseline as normal.

Do not raise every fixed threshold just to hide the transition. Review the P50, P95, sample count and derived threshold through the dashboard or MCP, then restore immediate degraded notifications.