Skip to content

Watchdog False-Positive Cascade: 11+ CRITICAL 'spacebot down' Alerts (Service Operational) #21

Description

@marcmantei

Timeline

2026-06-22 15:15–16:15 CEST (1 hour duration)

  • 11+ consecutive identical CRITICAL alerts: "spacebot down"
  • All alerts sent within a concentrated timeframe during normal operations

Confirmation: Service Operational

  • All spacebot services confirmed operational during the entire incident window
  • Watchdog alone reported "down" status
  • No actual service degradation or failure

Pattern Context: Recurring False-Positive Trend

  • Since May 31, 2026: 250+ false-positive "service down" alerts observed
  • Systematic pattern of watchdog misclassification
  • Recurring across multiple service monitoring windows
  • Part of broader log-parser reliability issues

Root Cause Analysis

The watchdog false-positives stem from log-parser misclassification:

  • Normal operational logs incorrectly flagged as failure indicators
  • Stale log entries evaluated as current failures
  • Parser inability to distinguish operational state from transient conditions
  • No architectural validation of alert conditions before escalation

Impact

  • ⚠️ Alert Fatigue: Cascading false alerts reduce team responsiveness to real incidents
  • 🔄 Automation Churn: False positives trigger unnecessary investigation workflows and resource consumption
  • False Escalations: Legitimate operational noise escalated as critical failures
  • 📉 Monitoring Credibility: Reduced trust in watchdog alerting system

Recommendation

Halt automatic per-alert investigation workflows. Until root cause is fixed:

  • Presume service is operational by default
  • Require manual console verification before investigation/escalation
  • This prevents alert-fatigue-driven automation cascades

Technical Note

This issue requires architectural parser/endpoint config review, not immediate token/service fixes:

  • Log-parser classification logic needs audit
  • Watchdog alert thresholds/conditions need validation
  • Integration between parser output and alert generation needs review

This issue documents a critical monitoring reliability problem that impacts incident response effectiveness.

Metadata

Metadata

Assignees

Labels

ai-taskbugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions