A worker that had been restarting every 40 seconds for eleven days, reported as active by every check that looked.
[Service]
Restart=always
RestartSec=5
# what was missing
StartLimitIntervalSec=300
StartLimitBurst=5
# with those, systemd gives up after 5 restarts in 5 minutes
# and the unit enters failed — which is a state something
# actually alerts on.Restart=always with no burst limit converts a hard failure into an invisible one, and a health check that asks systemd whether the unit is running gets a truthful yes several times a minute. The metric that would have caught it independently is process start time, and alerting on a worker whose uptime is under five minutes is a cheaper detector than reading logs.