1. Alert categories and starting thresholds
| Category | Alert | Starting threshold | Severity |
|---|---|---|---|
| Availability | Instance down / can't connect | 1 min | Critical |
| Availability | HA replica not synchronising | 5 min | Critical |
| Replication | Replica or standby lag | > the RPO (for example 60 s) | Major |
| Backup | No successful log backup | 2× the interval | Major |
| Backup | No successful full backup | 2× the interval | Major |
| Capacity | Data or log disk used | > 80% warn, > 90% critical | Major/Critical |
| Capacity | Transaction log full / WAL piling up | Log > 70% used, or WAL directory growing | Major |
| Performance | CPU | > 85% for 15 min | Warning |
| Performance | Blocking | Blocked sessions > 60 s | Major |
| Performance | Deadlocks | Above the baseline | Warning |
| Connections | Connections used | > 80% of max | Major |
| Errors | Severity ≥ 17 errors (SQL Server), FATAL/PANIC (PostgreSQL), ORA-00600/07445 (Oracle) | Any | Major |
| Security | Failed logins | Spike above the baseline | Warning |
Tune thresholds per tier after 2–4 weeks of baseline data.
2. Collect, don't just alert
- Query telemetry: Query Store (SQL Server),
pg_stat_statements(PostgreSQL), AWR/ASH (Oracle, licensed) or Statspack, Performance Schema plussys(MySQL). - Wait statistics: what the database spends its time waiting on.
- Trends: database size growth per week, for capacity forecasts.
-- PostgreSQL: top queries by total time
SELECT left(query, 80) AS q, calls, round(total_exec_time) AS total_ms, round(mean_exec_time,1) AS mean_ms
FROM pg_stat_statements ORDER BY total_exec_time DESC LIMIT 10;
3. Tooling options
| Stack | Tools |
|---|---|
| Open source | Prometheus + postgres_exporter / mysqld_exporter / sql_exporter / oracledb_exporter, Grafana, Alertmanager |
| Azure | Azure Monitor, database watcher for Azure SQL, Log Analytics |
| AWS | CloudWatch, RDS Performance Insights / CloudWatch Database Insights, Enhanced Monitoring |
| OCI | OCI Monitoring, Database Management, Operations Insights |
| Commercial | SolarWinds DPA/SQL Sentry, Redgate Monitor, Datadog DBM, Oracle Enterprise Manager |
4. Dashboards
One overview page per tier (all instances, red/amber/green), plus a drill-down per instance: CPU, memory, I/O latency, waits, top queries, connections, replication and backups.
5. Alert hygiene
- Every alert has an owner and a runbook link.
- Page people only for Critical alerts. Major alerts become tickets, and Warnings go to dashboards.
- Monthly review: delete alerts nobody acts on, and add alerts for incidents that weren't caught.
Tip
Alert on missing data too. A monitoring agent that stopped reporting looks exactly like a healthy, quiet database.