The Dead-Hours Audit

What your servers do between 1 AM and 6 AM without supervision · Hive80 Lab · Sep 2026

Nobody watches production between 1 AM and 6 AM. Not the on-call rotation (it's a phone in a drawer), not the dashboards (nobody is awake to read them), not the backups ("they ran last Tuesday, probably"). The dead hours are where reliability reputations are actually made — and where most teams are silently naked.

The 20-minute audit (run it tonight)

1. List what actually runs at night (5 min). crontab -l on every box, systemctl list-timers, your CI's scheduled pipelines, nightly imports, backups, cert renewals. Most teams discover 2–3 jobs they forgot existed.
2. Pick the worst one and pause it (2 min). A real job, tonight. Not a staging drill.
3. Time the detection (10 min). Start a timer. Who notices: an alert, a human, or nobody until morning? If the answer is "nobody for 6+ hours," you now know the true value of your night monitoring: zero.
4. Write the one-line finding (3 min). "Job X failed at 02:14. First detection: none. Recovery: manual at 09:00. Cost: one morning of fire-fighting." That line is worth more than any SLO slide.

The three artifacts that fix the dead hours

1. A heartbeat that pages a human. Check every 1–5 minutes; two consecutive failures push to a phone. If alerting requires opening a tab, it is not night coverage — it is day coverage with a sad login page.
2. A morning report the client can read. One email at 7 AM, plain language: what ran, what recovered, what needs a decision. Clients do not churn over outages; they churn over silence.
3. Runbooks a junior can follow at 3 AM. Symptom, first command, decision branch, escalation threshold, and what "fixed" looks like. If only one person can execute it, it is a diary, not a runbook.

Run the audit tonight. Your competitors are asleep — that is the whole point.