alert-backtestTest alert rules against history and incident replays before they page anyone: run the expression as a range query over 60 to 90 days, list every interval it would have fired, score it for recall and detection delay against the incident list (measured from user-impact start) and for false fires agai
broken-trace-huntFind where trace context is lost when traces are fragmented, have orphan spans or start mid-journey: measure orphan rate and single-span-trace rate by caller and callee pair to pin the break to one hop, then eliminate causes in fixed order - propagator mismatch, headers stripped by a proxy, gateway
business-metric-alertingAlert on drops in business throughput such as orders, sign-ups or payments when there is no error rate to burn: compare against an expected value from the same weekday and time of day over the last four to eight weeks (median, to resist past incidents), alert when the observed rate falls below a fra
cardinality-incident-responseStop a metrics cardinality explosion happening now: stop the growth first by finding the offending metric and label with the TSDB status endpoint or promtool tsdb analyze, drop it at the scrape (metric_relabel_configs) or the collector, which acts in minutes where a code fix takes a deploy, allow fo
change-event-correlationBuild one stream of change events and put it where responders look, so 'what changed' is answered in the first minute: a fixed record (what, system and environment, service name matching the telemetry resource name, actor, start and end time, link) fed by deploys, flag changes, config and secret upd
collector-backpressure-triageDiagnose an OpenTelemetry collector that drops, refuses or delays telemetry by reading its own metrics in pipeline order and naming the furthest-downstream unclean stage as the cause: receiver refused, processor refused (memory_limiter), batch size, exporter queue against capacity, enqueue failures,
continuous-profiling-rolloutIntroduce always-on production profiling with bounded overhead and a way to use it. Choose collection per runtime: language-level agents where offered, eBPF whole-host profiling only where stack unwinding works (frame pointers or unwind tables, interpreter frames resolved). Budget one to two percent
dependency-reliability-ledgerQuantify how much error budget dependencies consume and decide what to do about each: measure each from the caller's side as its own good-over-valid SLI, including timeouts and retries the vendor never counts; compute the composite (five serial dependencies at 99.9 percent cap you near 99.5); keep a
latency-histogram-designChoose histogram buckets and aggregation so latency percentiles and SLO ratios are correct: never average or sum percentiles, export histograms and aggregate buckets first (sum by le across instances) before taking the quantile, put a bucket boundary exactly at each SLO threshold so the good-events
log-volume-reductionCut log ingestion and storage cost without losing what incidents need: measure bytes rather than lines, rank ingest by service and then by message template (fingerprinted, weighted by retention days), cut the cheapest first (debug in production, health-check lines, a repeating error, oversized field
missing-metrics-huntFind why a metric graph has gaps, flatlines, drops to zero or shows nothing by walking from target to panel and stopping at the first break: is the target scraped (up, scrape duration), was the series cut at ingest (sample_limit, relabel drop), is remote write behind, then query-side traps - stalene
otel-collector-pipeline-reviewReview an existing OpenTelemetry collector configuration and its deployment topology before production, in a fixed order: processor order per pipeline (memory_limiter first, enrichment, sampler after trace-affinity routing, batch last), memory_limiter against the container limit with GOMEMLIMIT near
otel-semconv-upgradeUpgrade OpenTelemetry SDKs or instrumentation across a semantic-convention rename without blanking dashboards and alerts. Treat renames as a breaking API for every consumer: map old to new (http.method to http.request.method, http.status_code to http.response.status_code, http.server.duration in mil
service-dashboard-rebuildRebuild a service dashboard nobody can use during an incident so it answers, in order, is it broken, for whom, where, and what changed: rows for the SLI and error budget; traffic, errors and latency split by the dimensions that separated outcomes in past incidents (route, version, region); dependenc
slow-dashboard-fixMake a slow or timing-out Grafana dashboard fast and stop it hammering the metrics backend. Measure first with the panel query inspector, the backend query log and engine duration metrics, ranked by total cost across viewers and refreshes rather than one slow-looking panel; then fix in order of yiel
synthetic-monitoring-designDesign synthetic probes and journey checks that find outages real-user metrics cannot, and triage the ones that page for no reason: probe journeys where silence costs money (login, checkout) asserting on content or a state change rather than a 200; at least three external locations with paging on a
tail-sampling-tuningConfigure and tune tail-based sampling in an OpenTelemetry collector tier so errors and slow traces survive while volume drops: size decision_wait and num_traces from measured trace duration and arrival rate, route each trace to one sampler by trace id, order policies (errors, slow, named tenants, a
telemetry-migrationMove services between telemetry agents, SDKs or backends without breaking dashboards and alerts: vendor agent to OpenTelemetry, OpenTracing or Jaeger clients to OpenTelemetry, ELK to Loki, one metrics vendor to another. Inventory every consumer of the old names into a dependency table first, dual-sh
telemetry-redaction-auditFind and stop personal data, credentials and tokens leaking into logs, spans and metric labels: sample stored telemetry rather than reading code, count patterns (emails, card numbers with a Luhn check, JWT prefixes, authorization headers, long hex or base64 strings) per signal and source, fix at the
trace-latency-analysisUse traces to explain where a slow request or percentile spent its time: compare cohorts rather than reading one trace (slowest 1% against the median, split by version, region, tenant tier, payload size or cache hit), then budget one slow trace by hop - self time is parent duration minus the union o