monitoring

  • Automation that resolved a symptom and hid a cause

    A crash loop handled by a restart limit and an alert, which resolved the outage and delayed the diagnosis. Automatic recovery that stops a symptom without addressing the…

  • Percentiles per consumer, still the most useful label

    One label added in 2025, still the thing that surfaces problems no aggregate shows. A consumer at four times the aggregate is a signal that no absolute threshold…

  • An integration that returned 200 and did nothing

    A supplier endpoint answering successfully with an empty body, for eleven weeks, after the supplier was acquired. A successful response with no content is indistinguishable from a successful…

  • A schema change on a table nobody can lock

    A column type change on a table taking four hundred writes a second, and an ALTER that estimates four hours.

  • A container that logged to stdout and to a file

    An application writing to both, which doubles the disk and halves the usefulness of each. A container writing to a file is a container whose logs disappear when…

  • A runbook command check that caught three

    A weekly check that every command named in a runbook still exists, which found three after a refactor. A runbook is documentation that must execute correctly under pressure,…

  • A systemd unit with a restart limit that finally fired

    A burst limit configured in 2023 as a precaution, which took three years to be needed. Without the burst limit the worker would have restarted every five seconds…

  • A restart limit that fired for the first time

    A systemd burst limit configured in 2023 as a precaution, which took three years to be needed. Without the limit the worker would have restarted every five seconds…

  • A post-incident note written by somebody who slept through it

    An incident resolved automatically overnight, written up from the timeline rather than from memory. Writing it up from logs rather than from experience produced a better note than…

  • An alert into a channel nobody reads at 04:00

    An alert that fired correctly at four in the morning, into a channel that is read at eight. An alert that is correct, correctly routed and unread for…