There are three kinds of valid monitoring output: Alerts Signify that a human needs to take action immediately in response to something that is either happening or about to happen, in order to improve the situation. Tickets Signify that a human needs to take action, but not immediately. The system cannot automatically handle the situation, but if a human takes action in a few days, no damage will result. Logging No one needs to look at this information, but it is recorded for diagnostic or forensic purposes. The expectation is that no one reads logs unless something else prompts them to do so.
