The alert that will matter most here is the absence of logs: a small heartbeat from each node's rsyslog to the log host, and a page when a node has sent nothing for, say, ten minutes. That is the failure mode that quietly turns a working archive into a silent one. The rebuild-time win from 39 to 9 minutes is the kind of thing you only discover because you now have the data to measure it.
One thing worth designing in before you break it on purpose: run the checks from outside the cluster. If the probe lives in a VM on the same three nodes, it dies with the thing it is watching and you get a gap in the graph instead of an alert. And watch quorum separately from the workload. With three nodes you need two for quorum, so losing two leaves a healthy box that will not restart any HA resource. Use a real watchdog for fencing and power a node off hard when you test, a graceful shutdown mostly just migrates and teaches you nothing.
