概念概述
基于症状的告警（Symptom-Based Alerting）指的是：基于症状的告警针对用户可见问题而非内部原因触发，因多种原因共享同一症状而显著减少告警噪声。
从更严格的定义看，Symptom-based alerting is the practice of triggering alerts on outcomes users experience, such as elevated errors or latency, instead of on every possible internal cause such as a single host’s CPU. 该概念在工程实践中的价值，在于它能帮助团队用统一的语言描述一个具体的质量属性或设计约束，从而在评审与协作中减少歧义。
为什么需要它
It shapes on-call load and is central to keeping paging meaningful and actionable. 它与 Trace Context Propagation、Exemplars Linking Metrics to Traces、Operational Dashboard Design 等概念经常一起出现，用于解决相近的工程问题。理解它的适用场景，有助于在多种备选方案之间做出有依据的取舍，而不是凭直觉选择技术方案。
常见误解
- alerting on every cause catches incidents sooner
- symptom alerts cannot be used to detect early degradation
需要避免的反模式
- paging on a single host’s metric without a user impact signal
- letting one outage fan out into dozens of correlated pages
实践要点
- Because many internal causes produce the same user-visible symptom, alerting on the symptom keeps the page count low while still catching the incident.
- Cause-based signals are still valuable as dashboards and diagnostics, but they should not page unless they map to a real impact.
- A small number of high-quality symptom alerts, often tied to error budget burn, preserves trust in the pager instead of training responders to ignore it.