주제: observability
-
프로덕션에서의 지속적 프로파일링: 상시 가동되는 샘플링 프로파일과 이를 통해 답할 수 있는 것
지속적 프로파일링은 CPU와 메모리 프로파일을 시간에 걸쳐 체계적으로 수집해 레이블이 달린 시계열로 저장합니다. 그 덕분에 팀은 어제 전체 플릿에서 어떤 함수가 CPU를 가장 많이 소비했는지, 두 버전 사이에 무엇이 달라졌는지를 물을 수 있습니다. 샘플링 프로파일러는 이를 상시 켜 두어도 될 만큼 비용을 낮춰 주며, Go의 /debug/pprof/ 같은 런타임 엔드포인트나 eBPF 에이전트가 프로파일을 제공합니다.
-
트래픽이 적은 서비스에서 드문 장애를 놓치지 않게 하는 트레이스 샘플링 전략은 무엇인가?
열린 질문: 샘플링에 관한 일반적인 조언은 초당 수천 건의 트레이스가 발생해 1%만 추려도 대표성이 있는 서비스를 전제로 쓰여 있습니다. 초당 요청이 몇 건 안 되는 서비스에서는, 헤드 샘플링·테일 샘플링·경로별 비율·보존 기간을 어떻게 조합해야 팀이 받아들일 수 있는 비용으로 일주일에 한 번 있는 그 실패한 트레이스를 계속 남겨 둘 수 있을까요?
-
Alerts that page for symptoms, not causes
Alert on what users experience (error rate, latency, availability, freshness) with thresholds tied to objectives, route by urgency, and turn every noisy alert into either a fix or a deletion.
-
Which observability signals should a JVM or .NET service emit by default, and at what overhead?
Open question: both runtimes ship built-in telemetry (Flight Recorder and GC logging on the JVM; EventPipe counters and dotnet-trace on .NET) and both have OpenTelemetry auto-instrumentation, but there is little shared evidence on which of these should be always-on in production, what they cost, and which ones actually shortened incidents.
-
Log sampling for high-volume events: keep every error, sample the repetitive lines
Sampling drops a fraction of similar log events on purpose; the useful forms are one-in-N, burst-then-rate per period, per-level rules that leave warnings and errors untouched, and pipeline sampling keyed on a request ID so a whole request is kept or dropped together, with the applied rate written into the surviving events.
-
Verteiltes Tracing in Umrissen: Spans, Eltern-Kennungen und W3C Trace Context
Ein Trace ist ein Baum aus Spans, jeder mit Trace-Kennung, eigener Span-Kennung, Eltern-Span-Kennung, Zeitstempeln, Attributen und Status; der W3C-Header traceparent trägt Trace-Kennung, Eltern-Kennung und ein Sampled-Flag über Prozessgrenzen, und ein Dienst, der beide Header nur weiterreicht, hält Traces trotzdem zusammen.
-
Designing an operations dashboard: one question per panel, one screen per audience
Start from the questions a responder must answer, give each question one panel, order panels from general to specific, normalise units and axes, use template variables instead of copies, link every paging alert to the dashboard it needs, and keep the dashboard definition in version control.
-
Use correlation IDs across an agent task
Separate task identity, individual attempts and distributed trace context so retries can be followed without logging sensitive payloads.
-
Alarme sinnvoll gestalten: wenige Meldungen, jede mit einem nächsten Schritt
Ein Alarm, der jemanden weckt, muss dringend, handlungsleitend und für Nutzer spürbar sein; alles andere ist ein Ticket. Symptome an der Nutzerkante alarmieren, Schwellen an Ziele und die Verbrauchsrate des Fehlerbudgets binden, eine Wartezeit gegen Flackern setzen, das Runbook verlinken und jeden Alarm ohne Handlung wöchentlich abschaffen oder nachjustieren.
-
Replayable run logs for agents: recording every model and tool call
An agent run can only be debugged if every model request, response, tool call and tool result is recorded in order with identifiers and parameters; the OpenTelemetry GenAI semantic conventions name the fields, and a replayable log lets a failure be reproduced without paying for a new run.
-
Metric naming and label cardinality: units in the name, bounded values in the labels
Prometheus naming conventions put an application prefix, a base unit and a _total suffix for counters into the metric name and reserve labels for bounded dimensions; every distinct label combination is its own time series, so user IDs, raw URLs and error messages in labels multiply storage until the server degrades.
-
Correlation versus causation in incident and operations data
A correlation coefficient measures how two series move together; it says nothing about which one drives the other, whether a third factor such as traffic drives both, or whether the data were selected by the outcome. Plot first, condition on the obvious common causes, check timing, and confirm with an intervention such as a flag or canary before acting.
-
The RED method for request-driven services, with exemplars that link a slow bucket to a trace
Instrument every request-handling service identically with rate, errors and duration: one counter with route, method and status labels and one duration histogram; when tracing exists, attach exemplars (a trace ID with a recorded value) to the histogram so a slow bucket on the dashboard opens the trace that landed there.
-
Log rotation and retention limits
Logs must be bounded in size and age at every layer (application, container runtime, proxy, system journal), with retention chosen for debugging and legal needs rather than 'keep everything'.
-
Synthetic monitoring and uptime checks: probing from outside what users see
A synthetic check sends a scripted request from outside the system at a fixed interval and records whether the response was correct and how long it took; it is black-box monitoring in the SRE sense, catches failures that internal instrumentation cannot see (DNS, TLS, the load balancer, an expired domain), and must be probed from more than one place before it pages anyone.
-
Configuring the logging module once, at the entry point
Libraries obtain loggers and never configure handlers; the application configures handlers, levels and formats once at start-up, so that output is controlled in one place and duplicates are avoided.
-
Latency percentiles: why the average describes no real request
Latency distributions are skewed, so the mean sits between a fast majority and a slow tail and matches no actual request; p50, p99 and the maximum describe what users meet. Record histograms rather than pre-computed quantiles so percentiles can be aggregated across instances and recomputed for any window.
-
How should a dashboard show the uncertainty of a metric so that operators react to signal rather than noise?
Open question: dashboards draw a percentage from three requests with the same confidence as one from three million, and a p99 from a sparse histogram bucket as a precise line; which ways of showing sample counts, interval bands or estimation error have been shown to reduce false alarms and missed problems for on-call operators?
-
SLIs for queues and batch jobs: age of the oldest message, freshness, coverage and last success
Request-driven services measure availability and latency; queues and batch jobs need different indicators: how old the oldest unprocessed item is, what proportion of data is fresher than a threshold, what proportion of scheduled runs completed within their window, and when the job last succeeded. This methodology derives them from the pipeline SLIs in the SRE workbook.
-
Distributed tracing in outline: spans, parent IDs and W3C trace context propagation
A trace is a tree of spans, each with a trace ID, its own span ID, a parent span ID, timestamps, attributes and a status; the W3C traceparent header carries trace ID, parent ID and a sampled flag across process boundaries, and a service that only forwards both headers still keeps traces intact.
기계 판독 가능: JSON