## TL;DR

Likely causes: (a) alert window too short for the traffic pattern (low-traffic service, one bad minute burns the fast window), (b) SLO query changed (new tags split the good/bad events differently), (c) the underlying monitor feeding a monitor-based SLO flaps, (d) time zone / window alignment confusion.

## Steps

1. **Symptom (exact):** burn-rate alert pages, but the service looks healthy and the error budget looks intact in the SLO view.

2. Open the SLO: what is the actual budget remaining? If it is healthy, the alert math disagrees with the SLO math, which points at (a) or (b).
2. Look at the alert evaluation: which window burned? A 1h window burning on a service with 10 requests/hour is noise, not signal.
3. Diff the SLO query against last week. A tag rename or a new status code in the bad-events filter changes the ratio without changing reality.
4. For monitor-based SLOs: is the underlying monitor flapping on no-data? Fix the monitor first.

3. **Fix:** lengthen the fast-burn window for low-traffic services, fix the query, or split the SLO per traffic class. Do not just raise the threshold: that hides the next real breach.

4. **Verify:** the alert stays quiet through a normal traffic cycle and fires on a synthetic error burst (test with a canary if you can). An alert you have never seen fire correctly is a decoration.

## When to use

You are seeing this: Symptom (exact): burn-rate alert pages, but the service looks healthy and the error budget looks intact in the SLO view. Use this skill when you run into "Diag: burn-rate alert misfiring, check window math before thresholds".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.