Monitoring intervals
The check interval is your monitoring's sampling rate: it decides how often reality is observed. Between two checks, monitoring is blind — whatever happens in the gap is invisible unless it's still happening when the next check runs. Every interval choice is the same trade: shorter means faster detection and finer data; longer means less probe traffic and coarser truth.
What an interval can and cannot see
With a 5-minute interval, an outage lasting 4 minutes can fall entirely between two checks: users noticed it, and monitoring recorded nothing. If it clips one check, it produces a single failure — below any sensible threshold. As a rule, an interval can only reliably see outages at least as long as the interval itself, and can only open incidents for outages longer than interval × threshold.
A 1-minute interval catches essentially every outage longer than a minute — and the same resolution applies to latency: a day of 1-minute checks gives your charts and p95 calculations 1,440 samples instead of 288, so a 10-minute latency spike appears as ten data points instead of two.
Detection-time math
Time to alert is governed by two knobs together: the interval I and the failures-before-incident threshold N. A failure starts at a random moment, so the first failed check lands up to I later; the incident opens on the Nth consecutive failure. Worst case ≈ N × I.
| 1-minute interval | 5-minute interval | |
|---|---|---|
| Checks per day | 1,440 | 288 |
| Shortest outage reliably detected | ~1 minute | ~5 minutes |
| Incident opens (threshold 3) | ~2–3 minutes | ~10–15 minutes |
The multiplication is what surprises people: a 5-minute interval with the default threshold of 3 means a client-facing outage can run a quarter of an hour before the first email goes out — long enough that the client calls you first, which defeats the reason MSPs monitor in the first place.
Choosing an interval in UpAll
UpAll checks every 1 to 5 minutes, set per monitor, default 1. A reasonable policy:
- 1 minute for anything client-facing or covered by an SLA — the detection-time math above is the whole argument.
- Longer intervals for low-stakes internal targets, or for metered and fragile links where you genuinely want less probe traffic.
One side effect to know: the interval also drives staleness detection. A monitor with no fresh result for 3× its interval + 30 seconds shows as Unknown (monitor statuses explained) — so longer intervals also mean slower detection of a silently stalled monitor. Threshold tuning, which multiplies with the interval, is covered in check intervals and thresholds.