In surprisal terms, one signal fires in 999 minutes out of 1000 and another in one minute out of 1024 - which should page a human, and why?

## Put numbers on both signals first Surprisal is `-log2 p` for a single outcome, so the whole comparison is four small calculations - one for each signal and one for each complement. | observation | probability in a given minute | surprisal in bits | |---|---|---| | routine signal present | 0.999 | 0.0014 | | routine signal missing | 0.001 | 9.97 | | rare signal fires | 1/1024 | 10 | | rare signal silent | 1023/1024 | 0.0014 | Two things jump out. First, the routine signal's arrival is worth roughly a **seven-hundredth of a bit** - it resolves almost nothing, because you would have bet on it at 999 to 1 anyway. Second, the informative half of a near-certain signal is its **complement**: the missing minute carries about ten bits, essentially the same figure as the rare signal's firing. ## The information lives in the rare outcome This is the general shape of the result, and it is worth stating as a rule rather than an anecdote: - A signal that almost always fires tells you something only when it **fails** to fire. - A signal that almost never fires tells you something when it **does** fire. - In both cases the bits sit on the low-probability side, because `-log2 p` is large only where `p` is small. That is why a health check that emits a steady stream of confirmations is not, by itself, a source of information; the pipeline that watches for a *gap* in that stream is. The confirmations are the carrier; the gap is the news. ## What this actually decides Applied to routing, the measure gives you a defensible ordering rather than a gut feeling: 1. **Estimate the probability per observation window** for every trigger you are considering, from published or measured rates. 2. **Convert to bits.** Anything scoring a small fraction of a bit is confirming a prior, not reporting news. 3. **Invert the near-certain triggers.** Where the fire-side score is near zero, the absence-side score is large; trigger on the absence. 4. **Re-rank when the rates move.** A trigger that was informative at one rate becomes noise once the underlying event becomes routine. Step 4 is the one teams skip. A trigger's information content is a function of the current rate, so a signal that fired once a week and carried real bits becomes near-worthless once a change makes it fire every minute - and nothing in the alerting configuration notices. The same arithmetic that justified the alert originally condemns it afterwards. ## Information is not severity, and not volume Three separations keep this honest: - **Information is not cost.** A one-in-a-million event may be informative and harmless; a routine one may be catastrophic. Surprisal ranks how much an observation told you, and the decision to wake a human must also weigh what it costs to ignore. - **Information is not volume.** A signal firing sixty times an hour does not carry more information per firing than one firing once; if anything, higher frequency means a higher probability and therefore *fewer* bits per occurrence. - **Information is not loudness.** Severity labels are a human annotation. They are worth having, but they are not a measurement of anything, and they drift. The interviewer is usually probing exactly this boundary: a candidate who says "page on the rare one because rare means important" has skipped a step. Rare means *informative*. Importance is a second axis you must supply. ## When the model is wrong the conclusion is wrong Every number above rests on an assumed probability. If the routine signal's true availability is 0.9 rather than 0.999, its presence carries `-log2(0.9)` = about 0.15 bits and its absence about 3.32 bits - still asymmetric, but a tenth of the previously claimed gap, and a trigger on absence would now fire far more often than the earlier arithmetic suggested. Two practical habits follow: measure the rate rather than inheriting it from a document, and recompute when behaviour changes. Publishing a bit figure without the rate and the window it came from is publishing a number nobody can check. ## The answer an interviewer wants to hear A complete answer does four things in about a minute: puts `-log2 p` on both signals, notices that the near-certain one scores almost zero, flips it to its complement and notices the complement scores about ten bits, and then explicitly separates informativeness from severity before making the routing call. Averaging these per-outcome values across a whole distribution is a different measure with a different purpose and is not what this question is asking for.