MTTR, MTTA and MTTD: Definitions and How to Use Them
MTTR, MTTA and MTTD are the most quoted incident metrics and the most often confused. Fix the definitions first, then use the numbers as a signal about the system.
Three abbreviations dominate discussion of incident response. MTTD is mean time to detect. MTTA is mean time to acknowledge. MTTR is mean time to resolve, recover, respond or repair, depending on who is speaking. Each is an average of an interval across incidents, calculated as the total of the intervals divided by the number of incidents.
The intervals
- Time to detect: from the start of the problem to the first alert or report. It measures monitoring.
- Time to acknowledge: from the alert to a human taking responsibility. It measures paging and on-call reliability.
- Time to mitigate: from the start, or from acknowledgement, to the end of customer impact. It measures how quickly you reduce harm.
- Time to resolve: to the point where all work is done. It measures completion.
The R in MTTR is not agreed
Sources use MTTR for different intervals. Some measure it from the moment of acknowledgement to restoration of service. Others measure from the start of the incident to restoration, and others measure to the launch of a remediation plan. These can differ by hours for the same incident. A team that compares its MTTR with a published figure, or with another team, may be comparing different things.
Choose one definition, write it down and apply it consistently. Better still, report the separate intervals rather than a single MTTR, because they point to different causes. A long time to detect is a monitoring problem. A long time to acknowledge is a paging problem. A long time to mitigate is a response or design problem.
Atlas keeps mitigated and resolved separate. Mitigated records when customer impact ended, which is the number customers feel, and resolved records when the work was fully closed out. Reporting only one of them either flatters your recovery time or understates the work. Atlas calculates time to detect, acknowledge, mitigate and resolve from the recorded instants.
Count only what you mean to count
Exclude events that are not real responses. A false alarm closed in a minute lowers the average and says nothing about how well you handle genuine failures. Atlas excludes false alarms, duplicates and expected behaviour from every response figure for this reason. Count only the first acknowledgement, or the figure will improve each time another person opens the incident. Count a reopened incident to its final resolution.
Beware the average
Incident durations are skewed. Many are short and a few are very long, and the mean falls in a place that describes neither. For example, three incidents lasting 45, 20 and 250 minutes have a mean of 105 minutes, a figure that matches none of them. Use the median alongside the mean, and look at the longest incidents individually, because they cost the most and teach the most.
Small samples mislead. A month with two incidents tells you little. Look at a quarter or more, and look at the trend rather than a single number.
Use the numbers as a signal
- Do not set individual targets for these metrics. People will manage the number by changing when they declare or close incidents.
- Do set expectations per severity, such as a time to acknowledge for the most serious level, and check whether they are met.
- Pair the numbers with a count of incidents and a review of the worst ones.
- Treat a sudden change as a prompt to ask what changed in the process.