Same three symptoms before three failures = name…
When the same symptom triad precedes system failures across three independent incidents, document it as a named detection pattern and build an automated alert triggered by that specific combination.
When This Fires
- After the third incident where the same pre-failure symptoms appeared
- During postmortem analysis when reviewing incident timelines for precursor signals
- When building or improving monitoring and alerting systems
- Any context where early warning patterns have been observed but not formalized
Common Failure Mode
Documenting the pattern but not automating the alert. The documented pattern lives in a postmortem report that no one reads during the next incident. Automation is the point — the pattern fires automatically, alerting the team before the failure completes, giving them time to intervene.
The Protocol
When the same symptom combination precedes a third independent failure: (1) Document the pattern: name it, describe the three symptoms, note the typical time gap between symptom onset and failure. (2) Name it concisely: "memory-spike-error-log triad" or "Pattern-7: slow-query cascade." (3) Build an automated alert that triggers when all three symptoms co-occur within the identified time window. (4) Share the named pattern with the team so it enters the collective monitoring vocabulary.