Tallwatch
Back to blog
2 min read
IncidentsUptime monitoring

What to do when a customer says the site is down and your monitors are green

Green monitors and an angry customer can both be right. Here is a triage order that finds path problems, client issues, and blind spots without a flame war.

NK

Nabin Khair

Founder

What to do when a customer says the site is down and your monitors are green

Support paste: "Site is down." You open the dashboard. All green. The wrong response is "works for me." The right response is a short investigation that assumes they are describing something real.

Start with their facts

  • Exact URL
  • Error text or screenshot
  • Approximate location / ISP
  • Browser vs mobile app vs API client
  • Since when

"Down" might mean login loop, blank page, 403, slow spin, or payment failure. Those are different incidents.

Triage order that usually works

  1. Reproduce off your office network: phone cellular, or a colleague in another city.
  2. Look per region on your monitors and CDN analytics. Green in Virginia and red for them in Sydney is a story (everyone vs just me).
  3. Check auth and the specific flow: homepage up, checkout dead is still an outage for them.
  4. Check third parties on that path: IdP, payments, email magic links.
  5. Check their side gently: corporate VPN, DNS filter, extension. Offer a status link and a second device test without blaming.

When monitors were wrong

Your checks hit /health while customers hit /app. Your check allows 200s that are error pages (content checks). Your interval missed a ten-minute blip. Own it, fix the coverage, thank them.

When monitors were right

Something local or account-specific broke. Help them anyway. Update status only if impact is broader; do not flip the public page for one ISP.

Afterward

If this happens twice on the same path, you have a monitoring gap. Add the URL. Widen regions. Tighten what "success" means. Green dashboards that regularly disagree with customers are not a comfort; they are a liability.

Related

Keep reading

False alerts and status pages.

How to explain downtime to non-technical founders and investors

How to explain downtime to non-technical founders and investors

They do not need Kubernetes. They need impact, duration, cause at the right altitude, and what changes so it is less likely next time.

NKNabin Khair
When a CDN outage is your outage (even if origin is fine)

When a CDN outage is your outage (even if origin is fine)

Customers do not care that your origin returned 200 on a private path. If the CDN is how they reach you, its bad day is your incident.

NKNabin Khair
What acknowledge means on an incident (and why it matters)

What acknowledge means on an incident (and why it matters)

Ack is not resolve. It means a human owns the problem, and it should stop the escalation clock from climbing further.

NKNabin Khair