Operational Patterns

Alerting answers “is it broken now?” Patterns answer the slower questions usually found by staring at charts.

Warden recomputes findings daily over the last 14 days. Only successful checks feed latency detectors; timeout duration is not healthy performance data. Pausing a monitor clears its findings.

What Warden looks for

• Climbs and resets: latency rises for hours and falls sharply, a shape often associated with recycling or resource exhaustion.
• A schedule: repeated resets follow a cadence that may point to a timer or lease.
• Time of day: failures concentrate in a meaningful daily window rather than spreading randomly.
• Correlated monitors: outages overlap enough to suggest a shared cause.
• Getting slower or faster: median latency this week changes materially from last week.

Findings appear on the monitor page, through MCP list_insights, and in an optional weekly notification summary. Every finding includes the measurements behind it and a high or medium confidence label.

These are conservative, explainable rules—not opaque anomaly detection. The daily window and detector thresholds are intentionally not configurable today.