IP Addresses Belong in Log Content More Often Than Labels
A production-engineering deep dive into ip addresses belong in log content more often than labels, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
journald
Kernel OOM Logs Are the Ground Truth for Host Memory Kills
A process disappearing can look like an application crash unless the kernel journal is checked for OOM-killer activity.
Turning SSH Failures into a Production Security Signal
A production-engineering deep dive into turning ssh failures into a production security signal, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
How Logging Itself Can Become an I/O Workload
A production-engineering deep dive into how logging itself can become an i/o workload, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
The Stale Docker Container Problem in Alloy
A production-engineering deep dive into the stale docker container problem in alloy, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Seven Days of Logs Was an Engineering Choice, Not a Default
A production-engineering deep dive into seven days of logs was an engineering choice, not a default, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
SSH Failure Alerts Need Warning and Critical Bursts
A few failed SSH logins are normal on an administered server, while a rapid burst can indicate brute-force activity or a broken automation credential.
Journal Cursor Persistence Prevented Duplicate Log Ingestion
Restarting a log collector can replay old journal entries or skip new ones if it does not persist its position correctly.
Journald Cursor Persistence Prevents Duplicate or Missing Logs
A production-engineering deep dive into journald cursor persistence prevents duplicate or missing logs, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Docker Daemon Error Bursts Need a Separate Alert
Individual container logs can all look normal while the Docker daemon is failing image, network, storage or runtime operations underneath them.
Why Loki Labels Need to Stay Boring
A production-engineering deep dive into why loki labels need to stay boring, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Metrics Tell Me That Something Happened; Logs Tell Me What Happened
A production-engineering deep dive into metrics tell me that something happened; logs tell me what happened, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.