Incident lifecycle

This page explains how an incident opens, what you can add to it, and how it closes. Incidents are part of Pro and Team and live on the project's Incidents page.

#How an incident opens

Automatically. When a monitor's confirmed problem has lasted longer than the policy's Open after (5 minutes by default), UptimeX opens an incident, records the check's detail, and sends the alert. The severity is Partial outage for a down monitor and Degraded performance for a slow one. Heartbeat and scheduler monitors open theirs the moment they go down. A monitor has at most one automatic incident open at a time.

By hand. Choose New incident on the Incidents page to declare one yourself, for an outage UptimeX did not detect or one that spans several services. Give it a title of up to 120 characters, a severity, the affected monitors (at least one), and an optional first update. A manual incident starts in the Investigating status and sends no alert.

Severity is one of Degraded performance, Partial outage, and Major outage. Only a person sets Major outage.

#The timeline

Every incident has a timeline. An automatic incident starts with a Detected entry. Choose Post update on an ongoing incident to add an entry with any of:

• A status: Detected, Investigating, Identified, Monitoring, or Resolved.
• A new severity.
• A note of up to 2,000 characters.

Every update is public on the project's status page, so write it for your users.

#How an incident closes

An automatic incident closes on its own when the monitor has recovered and the recovery has held for the policy's Close grace (10 minutes by default). The incident's end time is the moment of recovery, not the end of the grace, and the all-clear alert goes out when it closes. If the monitor goes down again during the grace, the same incident continues and counts the flap.

A manual incident closes only when someone posts a Resolved update. Posting Resolved on an automatic incident closes it too. A resolved incident takes no further updates and cannot be reopened.

#After it closes

A resolved incident keeps a postmortem field for the write-up, up to 10,000 characters, kept with the incident in the dashboard.

Incidents stay on the Incidents page for 30 days on Pro and 90 days on Team, and in the status page's Past incidents section for 14 days. Deleting an incident removes it and its timeline at once.

#Acknowledging

On Team projects with on-call escalation turned on, an ongoing incident shows Acknowledge. Acknowledging stops further escalation pages for that incident. It does not resolve it. See Incident policy for escalation.

#Who can do what

Owners and admins declare incidents, post updates, write postmortems, and delete incidents. Owners, admins, and members can acknowledge an incident. Viewers can read incidents but not change them.

#What's next?

• Incident policy: the timings that open and close incidents.
• Publish a status page: where incident updates appear in public.
• When alerts fire: the alerts that accompany each edge.