We deleted 43 alerts in a single afternoon and pager volume dropped 30% overnight. Here is the rule we used to decide what to cut.

An alert that has never once led to a real action is not a safety net. It's noise that makes every real page slower to trust.

The action-rate rule

For every alert that fired more than five times in a quarter, we checked whether the responder's resolution field said anything other than "no action" or "self-resolved." Anything under a 10% action rate got flagged for deletion or demotion to a non-paging channel. This is a mechanical, defensible rule — nobody has to argue in a meeting about whether an alert "feels" useful.

from alert_history
| where fired_at > ago(90d)
| summarize fires = count(), real_actions = countif(resolution notin ("no_action","self_resolved")) by alert_name
| where fires >= 5
| extend action_rate = round(real_actions * 100.0 / fires, 1)
| where action_rate < 10
| order by fires desc

Demote before you delete

Not every low-action alert is worthless — some are early warnings that are correct to fire even if the fix is rarely urgent. Those got demoted to a dashboard tile or a daily digest instead of a page. Only alerts with zero real actions across the full quarter got deleted outright.

Make hygiene a recurring job, not a one-time cleanup

The 43-alert cleanup was satisfying but it will rot again if it's a one-time event. We now run the action-rate query on the first Monday of every month as a standing agenda item in the reliability review, so noise gets caught within weeks instead of accumulating for a year.

Tell people before you cut

We post the candidate deletion list in the team channel 48 hours before acting on it, rather than silently removing alerts the moment the query flags them. Twice this caught an alert that looked useless by the numbers but was actually a known-good check for a rare seasonal failure mode nobody had triggered in the sample window — a heads-up that took thirty seconds saved us from deleting something we'd have badly missed.

  • Compute action rate per alert; anything under 10% is a candidate for change.
  • Demote low-value-but-correct alerts to a dashboard before deleting them outright.
  • Delete only alerts with zero real actions across a full quarter.
  • Announce deletion candidates before acting — some quiet alerts guard rare failures.
  • Re-run the audit monthly — alert rot is continuous, not a one-time cleanup.