Same solution as every monitoring system: run a second, separate one. Whether it's the proverbial backhoe through the fibre link or a sysadmin fat-fingering a conf or deploy, there's always a way for a single system to be brought down.

I saw an absolutely crazy way to do this with Nagios[1]. Nagios saves its state in a file, and the suggested way to synchronise two separate systems was to have them look to see if the other one is active. If it is, sync the statefile across. If it isn't, start up nagios locally based on the latest sync'd statefile. I mean, the solution works, but due to Nagios it's inherently hacky. It's bizarre that Nagios doesn't (didn't?) have inbuilt support for failover this way.

[1]https://allmybase.com/2010/10/04/setting-up-fully-redundant-...