False positive (monitoring)

Definition

A false positive in monitoring is an alert that indicates a problem when the service is actually healthy for real users—often due to probe limitations, network partitions, or overly aggressive thresholds.

Common causes

• Single-region checks blocked by WAF or geo rules
• Short timeouts under load
• DNS differences between probe and user resolvers
• Third-party dependency flakiness unrelated to your core service

Mitigation

Use retries, multi-location confirmation, realistic timeouts, and maintenance windows. Tune alerts when patterns repeat without customer impact.

Related terms

See uptime monitoring and troubleshooting guides on false positives.