How do you prove afterwards that the system was actually working?
In short
Sooner or later somebody asks you to show that something was working: a client, an insurer, an authority, or your own management. Memory is not evidence and a screenshot is not a record. What answers that question is a history kept continuously, incidents with real timestamps, and a periodic report you did not write after the fact.
Every conversation about monitoring is about the future: we will find out sooner, we will be told faster. Then one day the conversation turns around, and somebody asks about the past. Was it working on the eleventh? For how long was it down? How do you know?
At that point the quality of your monitoring is measured differently. Not by how quickly it alerted, but by what it kept.
Why is memory not evidence?
Three weeks after an outage, nobody remembers it accurately. The duration shrinks or grows depending on who is talking. The start time becomes “around lunchtime”. A screenshot proves that a screen looked a certain way when somebody took it, which is not the same as proving what happened.
What survives scrutiny is a record produced while things were happening, without anyone deciding to produce it: checks that ran on a schedule, an incident opened automatically at the first failure rather than when a human noticed, a closing time, and the notes written during the fix. The value of that record comes precisely from the fact that nobody chose to write it.
What should the record contain?
- What was watched, named plainly, so a reader who is not technical can tell what it was.
- When it stopped answering, and when it came back, with the incident dated from the first failed check rather than from the moment someone looked.
- Where the checks ran from, because “unreachable from outside” and “broken” are different claims and only one of them is usually true.
- What was done in between: acknowledged at this time, investigated, resolved. Short notes, written then.
- What was planned, kept separate from what failed. Announced maintenance is not an outage, and being able to show that distinction is what stops an argument about a number.
- A periodic summary produced on a schedule — availability, response times, the incidents of the month, the maintenance, the state of certificates and hosting — arriving by e-mail whether or not anything interesting happened. A report written on the day it is needed is worth very little.
The Swiss angle, stated carefully
The Swiss Data Protection Ordinance (RS 235.11) is the one text we have found that speaks directly to this. Article 3 paragraph 2 letter e asks that measures be taken so that malfunctions are reported. Paragraph 3 letter c asks that breaches of security be identified quickly. Article 4 paragraph 5 asks that logs be kept for at least one year, separately from the system they describe.
Read it for what it says. It asks you to be in a position to notice, and to keep the trace. It does not mandate any product, ours or anyone else’s, and any supplier who tells you their tool is “required by law” is telling you something that is not in the text. What is true is narrower and still useful: if you have to show that you were watching, the trace has to exist before the question is asked.
The same principle shows up elsewhere with different words. Guidance on video surveillance across Europe expects recordings to be kept only briefly — days, not months, with anything longer justified — and in Switzerland the usual expectation is around twenty-four hours. Which means the evidence you will be asked for is very often not the footage at all. It is the record of whether the system that should have captured it was working.
What to do this week
- Take your last real outage and try to answer, from documents alone: when did it start, when did it end, who was told. If you cannot, that is the finding.
- Make sure incidents are opened from the first failed check, not from the moment someone noticed.
- Schedule the periodic report so it arrives whether or not you ask for it, and keep the ones that arrive.
- Declare your maintenance in advance, so that planned work never has to be argued about afterwards.
- Decide how far back you need to be able to look, and check that your plan’s retention actually goes that far. This is the one decision that cannot be fixed retroactively.
The day someone asks you to prove it, you will not be able to start. You will only be able to open what you already have.
What we cannot tell you
- We cannot prove that a system was doing its job: we can show what our checks saw, from where they ran and at what time, which is evidence of surveillance, not a certificate of correct operation.
- We cannot give you legal advice and nothing here is one: whether your documentation satisfies an obligation is a question for a lawyer who has read your situation.
- We cannot show you detail we no longer hold: the per-check history is kept for a period that depends on your plan, from two weeks to two years, while incidents remain.
- We cannot export the raw data as a spreadsheet: reports come as PDF and e-mail, and there is no CSV or Excel export today.
Questions people actually ask
Who actually asks for this?
More people than you would expect. A client after a disputed outage. An insurer after a claim. A supervisory authority after an incident involving personal data. A landlord, a franchisor, a parent company. And most often your own management, three weeks later, asking how long it really lasted — a question memory answers badly and confidently.
Is there a Swiss rule that says anything about this?
The Swiss Data Protection Ordinance (RS 235.11) asks, at Article 3 paragraph 2 letter e, that measures be taken so that malfunctions are reported. It is worth reading carefully: it requires you to be able to notice, it does not require any particular product. Being able to show that you were watching helps you meet that expectation; it is not a legal certification, and we will not describe it as one.
What counts as evidence and what does not?
A record produced continuously, while things were happening, counts. A document assembled afterwards from memory does not, and everyone in the room knows the difference. The useful shape is boring: this is what was watched, these are the checks, this is when it stopped answering, this is when it came back, this is what we did in between.
How long should this be kept?
Longer than you think you will need, because the question always arrives late. The same ordinance asks that logs be kept for at least a year and separately from the system they describe. Our own retention of per-check detail runs from two weeks to two years depending on plan, and incidents are kept without that limit — so the length of your evidence is a decision you make when you choose the plan, not afterwards.
Does a status page help?
Yes, for a reason that has nothing to do with technology: it is dated, public and written at the time. A page that says what was happening, in the visitor's language, is both a way to stop twenty phone calls and a record nobody can claim was invented later.