Q: After an outage, what monitoring data should I actually save?

Q: After an outage, what monitoring data should I actually save?

A: Capture enough to answer "when, where, and how long" without arguing about it later. At minimum keep: exact first-failure and recovery timestamps, which monitoring locations failed (one region or all), the status codes and response times leading into the outage, and the raw response body from the failing checks.

That last one is gold. The error page your monitor captured at 3am is often the only forensic evidence of what actually broke, long after logs have rotated.

Then compute the real duration from confirmed-down to confirmed-recovered, and log it against your error budget so you can see the monthly trend, not just one-off pain.

Follow-up: keep this history at least 12-13 months. You'll need it to prove SLA compliance to customers and to argue SLA credits with your own providers, both of which require receipts.

Got a question? Drop it in the comments.