;)
In our last post, we introduced Quisitive’s custom-built Tie Fighter which we call EverWatch. EverWatch is a monitoring solution designed to bring clarity and control to the chaos of cloud and on-prem operations using the power of the Azure cloud. Now, let’s open the cockpit and show you how we actually fly this thing.
The On-Shore Team: Mission Control
At the heart of EverWatch operations is our onshore team, which acts as mission control. This team is responsible for:
- Alert monitoring: Throughout the business day, the onshore operations team monitors for alerts in near real-time, provides acknowledgement of alerts (averaging an impressive acknowledgement time of just 10 minutes).
- Daily triage standups: Every morning, the Quisitive monitoring team meets to review alerts, identify patterns, and prioritize responses. This rhythm ensures they are not just reacting to issues but proactively spotting trends before they become problems. The monitoring team works together with your AMS coach to resolve issues identified by these alerts. An example of this dashboard is shown below.
- Weekly extended triage: These sessions go deeper, analyzing anomalies, reviewing trends, and coordinating as a team to refine alert rules based on what they are seeing across our customer base. An example of the weekly alert review is shown below showcasing the count of alerts by noisiest resources and alerts as well as assessment of anomaly scores.
Other reviews occur weekly including an assessment of MTTA (mean time to acknowledgement) and MTTR (mean time to resolution), alert volume, and breakdown of personnel who acknowledge and resolve alerts as shown in the graphic below.
- Escalation management: Quisitive uses PagerDuty to route critical alerts to the right people at the right time. This ensures that high-priority incidents are not missed and always acted upon quickly. Alerts requiring customer intervention are escalated using a standard process to notify who you choose to have notified about what you choose to have them notified about. Below is an example of an escalation plan used by the team.
24x7 Offshore Support: Around-the-Clock Vigilance
While our onshore team sleeps, our offshore team keeps watch. This global coverage is a key part of our value proposition:
- Near-Real-time alerting: EverWatch continuously monitors Azure environments for issues like high CPU usage, low disk space, or memory pressure. When something goes wrong, our offshore team is the first to know and act.
- Follow-the-sun model: Escalations are seamlessly handed off between time zones, ensuring no alert is left unattended. This model minimizes downtime and maximizes responsiveness for our customers who allow offshore alert review and initial investigation.
Tooling That Learns and Adapts
EverWatch isn’t just a static dashboard. EverWatch is a living system that evolves with our customers’ needs:
- Policy enforcement: We deploy best-practice policies across all Azure resources, including future deployments. These policies are constantly updated to reflect changes in the Azure ecosystem, such as the shift from MMA to AMA agents.
- Anomaly detection: Our tooling identifies deviations from expected behavior and calculates anomaly scores to flag significant changes—both positive and negative.
- Custom alert tuning: Based on real-world experiences with our customers, we continuously redesign and enhance alerts to reduce noise and increase our monitoring capabilities. The team is effective at identifying pattern shifts that indicate a change in normal behavior. A simple example of this is a server that is low in memory such as the one shown below.
- Knowledgebase (KB) and Wiki: An important piece of the usage of EverWatch is the knowledgebase (or KB). The KB includes information about what to do with alerts on a customer’s alerts or alerts for a specific resource. The wiki includes general customer information including the default alert response, contact information and other relevant data for the customer.
- Diagnostics and Recoveries: The AMS monitoring team is building the foundation to provide automated or approved and then automated responses to alert conditions including diagnostics and recoveries. Diagnostics are done to provide more information about what caused an alert to occur. Recoveries are performed to resolve an alert using automation (often with the approval of the monitoring team or the customer). An example of a diagnostic would be showing what is using significant amounts of memory in a low memory condition such as the one shown above. An example of a recovery would be the restarting of a service that is often known to have a memory leak.
Meeting Rhythms and Internal Collaboration
Our internal development and operations are just as structured as our tooling:
- Backlog reviews: We prioritize features and fixes that support both keeping EverWatch functional even when Microsoft makes changes and balancing that with short and long-term innovation.
- Cross-functional collaboration: From automation engineers to solution coaches, our team works across disciplines to ensure EverWatch delivers value at every layer—from Tier 1 alerting to executive reporting.
Why It Matters
Without EverWatch, many of our customers wouldn’t know if something was broken in their Azure or on-prem environments. It’s not just about alerts. It is about providing insight, action when things go wrong and assuring that the environment is healthy.
Summary: With EverWatch, you can ensure that your systems are running smoothly and efficiently. Our innovative solution is designed to help you manage your resources more effectively, providing you with the insights you need to make informed decisions.
Are your systems running sluggish or not very responsive? Could you be spending too much on resources that you don't need? EverWatch is here to help you answer these questions and more. Join us in revolutionizing resource management and ensure that your system operates at its best.
Check out the other blogs in this series:
