Comment by mjulian

Bit of shameless self-promotion here, but I'm the author of Practical Monitoring. Among other things, I set out to answer exactly this question. Check out Part 2 (Chapters 7, 8, and 9 answer your question specifically). https://www.practicalmonitoring.com/