Bad alerts: anything that fires without requiring a human to take action. They cause alert fatigue and erode trust.
Good alerts:
- Symptom-based, not cause-based — alert on "users see errors," not "CPU is high"
- Actionable — there's a clear runbook entry for what to do
- Tied to SLOs — alert when error budget burn is too fast
- Severity-appropriate — pager for outages, ticket for slow degradation