Managed Services
The 3 a.m. test: what 24×7 support should really look like
Every provider promises round-the-clock cover. The real test is what happens when something breaks at three in the morning, and whether you hear about it from them or from your users.
Coverage is easy to promise
Round-the-clock monitoring is on almost every managed service brochure. It is easy to promise and easy to buy. Whether it works shows up in a single moment: a storage array degrades at 03:00, and either someone acts before the morning shift arrives, or the first sign of trouble is a phone call from a user at 08:30.
Whether monitoring is run by your own team or by a provider, these are the questions that separate real cover from a dashboard nobody watches.
The measure of monitoring is not how much it watches. It is what it catches before your users do.
Seven signs of monitoring that works
- A written scopeWhich systems are covered, which signals are collected, from availability and performance to capacity and security events, and what is explicitly out of scope. Known gaps can be managed. Unknown ones cannot.
- Alerts with ownersEvery alert has an owner and a runbook. Thresholds are tuned to your environment, duplicates are grouped, and noise is measured and reduced over time.
- Response targets by severityClear targets to acknowledge and resolve each severity, with a named escalation path. The difference between being notified and having it fixed is written down.
- Service contextA failed disk is shown as a risk to the payroll system, not just as a device name, so priorities follow business impact.
- Early warning on capacityTrends in storage, bandwidth, licences and certificate expiry are flagged weeks before they become outages.
- Changes beside incidentsWhen something breaks, the first question is what changed. Recent changes should appear next to the incident.
- Reports worth readingA monthly view of incidents, root causes, recurring issues and agreed actions, not just an availability percentage.
Warning signs
- Users report outages before the monitoring does.
- The team ignores alerts because most turn out to be noise.
- The same incident recurs month after month with no root cause recorded.
- Reports arrive on time and nobody opens them.
Five questions to ask before you sign
- Show me last month’s alerts. How many led to action?
- Who is on shift at 03:00, and what can they fix without waking anyone up?
- How are thresholds reviewed, and how often?
- What happens when an alert fires for a system nobody owns?
- Which incidents last quarter were caught before users noticed?
