DevOps: KPIs
Availability, detection and cost measures for an AIOps function, including self-detection rate, remediation success and why uptime alone is a comfortable lie.
Markdown. No sign-up, no email.
Uptime is the number everyone reports and the least useful one available. A service can be up and serving errors, up and taking nine seconds, or up and returning stale data to every customer.
These measure whether problems were found early, fixed fast, and paid for sensibly.
The six that matter#
| Measure | Definition | Target | How it gets gamed |
|---|---|---|---|
| Self-detection rate | Incidents found by monitoring rather than by a customer | Above 95% | Not counting a customer report as an incident once monitoring later fires |
| Mean time to detect | Fault beginning to alert raised | Under 5 min | Measuring from when the alert fired rather than when the fault began |
| Mean time to restore | Detection to service restored | Under 60 min | Declaring "restored" at partial recovery |
| Change failure rate | Deploys causing degradation | Under 15% | Reclassifying a rollback as a planned change |
| Remediation success | Automated fixes that resolved without escalation | Above 90% | Counting a restart that ran three times as three successes |
| Cost per unit of load | Spend divided by requests or users served | Falling | Watching total spend, which can fall while efficiency worsens |
Self-detection rate is the number that says whether AIOps is real. If customers still find most problems first, the watching is decorative regardless of how many dashboards exist.
Cost per unit of load, not total spend. Total spend falling during a quiet month looks like a win and may hide worsening efficiency that will surface the moment traffic returns.
Two counter-metrics#
| Counter-metric | Catches |
|---|---|
| Alert-to-action ratio | Alerts that nobody acts on. Above roughly 5:1, the team has learned to ignore the channel and the next real alert dies there |
| Repeat incidents within 30 days | Restoring service without fixing the cause. An automated restart is very good at hiding this |
Capacity and cost, reviewed monthly#
| Question | Bad answer |
|---|---|
| What runs out next, and when? | "We don't know" |
| What is provisioned and unused? | Anything for more than 30 days |
| Which resource grew fastest this month? | Growth nobody can explain |
| What expires in 90 days? | Certificates, keys, licences, domains. Expiry is the most predictable outage there is and still one of the most common |
What is deliberately not measured#
- Uptime alone. Comfortable and frequently untrue in the way that matters.
- Alert volume. More alerts is not more safety; past a point it is less.
- Tickets closed. Rewards closing over fixing.
- Automation coverage. A count of scripts, not of reliability.
Cadence#
| Continuous | Detection |
| Daily | Overnight anomalies, automated actions taken and whether each held |
| Weekly | Alert-to-action ratio, repeat incidents |
| Monthly | Capacity projections, cost per unit of load, unused resources, 90-day expiry list |
| Quarterly | Remediation allowlist review. It grows by exception and shrinks only when someone chooses to look |