---
title: "False Positive — monitoring glossary"
description: "A false positive is a monitoring alert that fires when nothing is actually wrong — a transient network blip, a momentary CPU spike, a single failed probe…"
canonical: "https://lemwatch.com/glossary/false-positive"
source: "https://lemwatch.com"
---

# False Positive

> A false positive is a monitoring alert that fires when nothing is actually wrong — a transient network blip, a momentary CPU spike, a single failed probe that recovered immediately. False positives are the primary cause of alert fatigue.

## Definition

 False positives in uptime monitoring are usually caused by single-region transient failures: the probe location hit a brief routing issue, the DNS cache momentarily missed, the TLS handshake timed out under load. None reflect a real customer-facing problem.

 The industry-standard fix is confirm-and-retry logic: never alert on a single failure. Require N consecutive failures from M different regions, with a brief retry interval, before opening an incident.

## Why it matters

 Every false positive trains the on-call team to ignore alerts. A monitoring system with a 5% false-positive rate is unusable; one with under 0.5% is trustworthy. Fixing false positives is the single biggest improvement you can make to operational signal quality.

 See it in the product: [Smart alerting](https://lemwatch.com/features).


## Related

- [Monitoring glossary](https://lemwatch.com/glossary)
- [Alert Fatigue](https://lemwatch.com/glossary/alert-fatigue)
- [Incident](https://lemwatch.com/glossary/incident)
- [Website Monitoring](https://lemwatch.com/glossary/monitoring)
- [Recovery Time Objective](https://lemwatch.com/glossary/rto)
- [Recovery Point Objective](https://lemwatch.com/glossary/rpo)
- [All monitoring checks](https://lemwatch.com/features)
- [Five Nines (99.999% uptime)](https://lemwatch.com/glossary/five-nines)