How quorum decides
Failing, healthy and excluded regions, monitor states, hysteresis and flap detection.
A single probe can be wrong: its network, its DNS resolver or its data centre can fail while your site is fine. Heimdall therefore only declares a monitor down when enough regions agree.
Region states
- Failing: the region’s last
fail_thresholdresults all failed - Healthy: the region’s last
recovery_thresholdresults all passed - Excluded: no result for 3 × interval, or the probe reported itself degraded
Monitor states
| State | Rule |
|---|---|
down | failing regions ≥ quorum; opens an incident |
up | healthy regions ≥ quorum |
degraded | at least one failing region but below quorum, or slow in ≥ quorum regions |
unknown | fewer available regions than the quorum; admins get a “monitoring degraded” alert |
paused / maintenance | set by you or a maintenance window; no evaluation, no alerts |
Example: three regions, quorum 2
| ist | stc | fra | Result |
|---|---|---|---|
| failing | healthy | healthy | degraded, nobody is paged |
| failing | failing | healthy | down, incident opened |
| failing | excluded | healthy | degraded, 1 of 2 available regions failing |
| healthy | excluded | excluded | unknown, admins notified |
Hysteresis and flapping
A down monitor only returns to up once the up rule holds, so one recovering region cannot close the incident early. If a monitor changes state more than 4 times in 30 minutes it is marked flapping: the incident stays open and you get a single alert instead of a storm.