Incidents and quorum

HTTP, ping and DNS checks run from edge pollers in several regions. A single failed request does not open an incident. The outage must be confirmed first.

How an outage is confirmed

Each site has a primary region, set on the site's edit page. A poller's failure vote counts once that poller has failed the check as many times in a row as the check's failure threshold (2 by default, 1 to 10 in the check settings).

• Single-region mode (the standard mode): the incident opens when the primary region and a second region both have counted failure votes, and that agreement has lasted at least 60 seconds. A failure seen only from the primary region waits for the second region.
• No second region available: if no active poller outside the primary region is assigned to the site, the primary region alone opens the incident after at least 3 failures in a row. The incident is marked as seen from one region only.
• Multi-region mode (set by operators): the incident opens when more than half of the site's healthy assigned pollers report the failure for at least 60 seconds.

If no healthy poller is online for the site, no incident opens; that state points to a monitoring problem, not a site problem.

The incident start time is the first failed observation of the vote that completed the confirmation, not the oldest failure of a single poller.

How an incident closes

The incident resolves when the failing votes no longer meet the same rule for 60 seconds. One region that keeps failing on its own, for example because a firewall blocks it, cannot hold an incident open, and a short flap cannot close one.

Heartbeat incidents do not use this vote: a missed heartbeat opens the incident directly and the next ping closes it.

Investigating

Open Incidents and select an incident to see its start, duration, failure reasons and updates. The Regions panel shows the current confirmation votes by poller, region, status and time. Votes are cleared on recovery, so older incidents may show no votes.

To investigate a missing alert, check the check result, the region votes, active maintenance windows and snoozes, the channel's alert types for the site, and email verification. A channel test validates the destination only; it does not prove that an incident met the confirmation rule.

Team members can post incident updates and choose whether to publish them on status pages. Export the site's incidents as CSV from the incident list, or through the API.