Multi-window, multi-burn-rate alerting checks burn rate over a long and a short window together. The long window proves the burn is significant; the short window proves it’s still happening. This catches fast outages and slow leaks with fewer false alarms. The approach comes from the Google SRE Workbook.
Common starting thresholds for a 30-day SLO
| Budget spent | Long window | Short window | Burn rate | Response |
|---|---|---|---|---|
| 2% | 1 hour | 5 minutes | 14.4 | Page |
| 5% | 6 hours | 30 minutes | 6 | Page |
| 10% | 3 days | 6 hours | 1 | Ticket |
Fast outage
1 h window16× ▲
5 min window22× ▲
FiresPage. SteadyNines opens a situationBlip, already over
1 h window15× ▲
5 min window0.4× ▼
QuietNo page. The burn has stoppedSlow leak
6 h window6.5× ▲
30 min window7× ▲
FiresPage at 5% of budget spentTick: threshold for that pair (14.4× for 1 h / 5 min, 6× for 6 h / 30 min).
Where SteadyNines goes further
These thresholds decide when to tell a person. SteadyNines uses the same signal to open a situation, find the cause and propose the action, so the response starts the moment the alert would.
See the loop in SteadyNines