Incident severities
Every incident in UpAll carries one of three severities. The severity tells anyone scanning the record how bad it was without reading the details — which only works if severities are applied consistently. This article covers what each level means, which sources produce which, and how to choose when you're writing an incident yourself. For the general concept, see incidents and severity.
The three levels
| Severity | What it says |
|---|---|
| Outage | The service was down — checks failing, users locked out. |
| Degraded | The service worked, but impaired — slow, partial, or at risk. |
| Info | Nothing was broken; this is context worth recording. |
Which source produces which
| Source | Severity |
|---|---|
| Automated checks — consecutive failures reached the monitor's threshold | Always Outage |
| Certificate expiring within 30 days | Info |
| Certificate expired or unreadable | Degraded |
| Manual incident written by staff | Your choice of the three |
Check-driven incidents are always Outage because the only thing a streak of failed checks proves is that the target stopped answering — automation doesn't grade shades of broken; see how incidents open and close. The certificate ladder maps urgency honestly: a certificate inside its last month is a warning (Info), while an expired or unreadable one is actively harming users (Degraded) — the full mechanics are in certificate incidents.
Degraded status is not a Degraded incident
A response slower than the monitor's degraded threshold turns the monitor's status amber, but it never opens an incident — latency over the threshold is a signal on the charts, not an event in the record. If a slowness episode deserves a place in the incident history, write it up as a manual Degraded incident. See degraded latency threshold.
Choosing a severity for manual incidents
When you create a manual incident, ask what the reader should conclude at a glance:
- Outage — the service was actually unavailable to its users, whatever the cause: upstream provider down, power failure, hard crash.
- Degraded — users could work, but worse than normal: slow responses, one feature down, intermittent errors.
- Info — nothing failed; you're recording context: planned work completed, a configuration change, an advisory.
The discipline pays off later. Incident history accumulates into the record you and your clients look back on, and a log where "Outage" always means the same thing is a log you can defend.