Monitoring & Observability
Framework for defining service level indicators, objectives, and error budgets.
SLI/SLO Definitions
Service Level Indicator (SLI)
A quantitative measure of service quality from the user's perspective.
Common SLIs:
- Availability:
(successful_requests / total_requests) * 100
- Latency: P50, P95, P99 percentiles
- Error Rate:
(error_requests / total_requests) * 100
- Throughput: Requests per second
- Freshness: Time since last successful data update
Service Level Objective (SLO)
A target value for an SLI over a time window.
Example:
- SLI: Availability
- SLO: 99.9% over 30 days
- Window: Rolling 30-day window
Service Level Agreement (SLA)
A business commitment with consequences if SLO is violated (usually customer-facing).
Error Budget Policy
Error budget = 100% - SLO target
Example:
- SLO: 99.9% availability
- Error budget: 0.1% downtime = 43.2 minutes/month
Error Budget States
| State |
Budget Remaining |
Action |
| Green |
> 50% |
Normal feature velocity |
| Yellow |
25-50% |
Reduce feature velocity, focus on reliability |
| Red |
< 25% |
Feature freeze, reliability work only |
| Exhausted |
0% |
Emergency reliability sprint |
Burn Rate
Rate at which error budget is consumed.
- Fast burn: > 14x normal rate → Alert immediately
- Slow burn: 2-14x normal rate → Alert within 6 hours
- Normal burn: < 2x normal rate → Monitor
Alert Design Principles
Good Alerts
✅ Actionable — Clear action to take when alert fires
✅ Specific — Precise condition, not vague "high CPU"
✅ Not noisy — Only alert on real issues, not transient spikes
✅ Documented — Runbook exists for every alert
✅ Tested — Alert has been tested and works
Bad Alerts
❌ Noisy — Fires frequently without real issues
❌ Vague — "Something is wrong" without specifics
❌ Non-actionable — No clear remediation steps
❌ Undocumented — No runbook or context
❌ Untested — Never verified to work
Alert Severity
- Critical: Immediate action required (SEV1)
- Warning: Action needed soon (SEV2)
- Info: Monitor, no immediate action (SEV3/SEV4)
Dashboard Design Guidelines
USE Method (Infrastructure)
- Utilization: CPU, memory, disk, network
- Saturation: Queue depth, wait time
- Errors: Error rate, failed requests
RED Method (Services)
- Rate: Requests per second
- Errors: Error rate
- Duration: Latency (P50, P95, P99)
Dashboard Best Practices
- Top-level: Overall health, key SLIs
- Drill-down: Per-service, per-region views
- Time ranges: 1h, 6h, 24h, 7d, 30d
- Annotations: Deployments, incidents, changes
- Alerts integration: Show active alerts on dashboard
Capacity Planning Framework
Steps
Measure Current Usage
- CPU, memory, disk, network
- Request rate, database connections
- Storage growth rate
Forecast Demand
- Historical growth trends
- Business projections
- Seasonal patterns
Calculate Capacity Needs
- Headroom: 20-30% buffer
- Growth: 3-6 month projection
- Peak: Handle 2-3x normal load
Plan Scaling
- Horizontal: Add more instances
- Vertical: Increase instance size
- Auto-scaling: Configure triggers
Review Regularly
- Monthly capacity reviews
- Adjust forecasts based on actuals
- Update scaling policies
Capacity Planning Template
# Capacity Plan: {Service Name} — {Quarter}
## Current State
- **Instances**: {Count}
- **CPU Usage**: {Average}% (Peak: {Peak}%)
- **Memory Usage**: {Average}% (Peak: {Peak}%)
- **Request Rate**: {RPS} (Peak: {Peak RPS})
## Forecast
- **Growth Rate**: {X}% per month
- **Projected Load**: {Future RPS} in 3 months
- **Peak Multiplier**: {X}x normal load
## Capacity Needs
- **Required Instances**: {Count}
- **Headroom**: {Percentage}%
- **Scaling Strategy**: {Horizontal/Vertical/Auto}
## Action Items
- [ ] {Action} — Owner: {Name} — Due: {Date}
Monitoring Checklist
1---2name: monitoring3description: Framework for defining SLIs/SLOs, designing alerts and dashboards, and tracking error budgets. Use when setting up monitoring, reviewing SLOs, or optimizing observability.4---56# Monitoring & Observability78Framework for defining service level indicators, objectives, and error budgets.910## SLI/SLO Definitions1112### Service Level Indicator (SLI)1314A quantitative measure of service quality from the user's perspective.1516**Common SLIs:**17- **Availability**: `(successful_requests / total_requests) * 100`18- **Latency**: P50, P95, P99 percentiles19- **Error Rate**: `(error_requests / total_requests) * 100`20- **Throughput**: Requests per second21- **Freshness**: Time since last successful data update2223### Service Level Objective (SLO)2425A target value for an SLI over a time window.2627**Example:**28- **SLI**: Availability29- **SLO**: 99.9% over 30 days30- **Window**: Rolling 30-day window3132### Service Level Agreement (SLA)3334A business commitment with consequences if SLO is violated (usually customer-facing).3536## Error Budget Policy3738Error budget = `100% - SLO target`3940**Example:**41- SLO: 99.9% availability42- Error budget: 0.1% downtime = 43.2 minutes/month4344### Error Budget States4546| State | Budget Remaining | Action |47|-------|------------------|--------|48| **Green** | > 50% | Normal feature velocity |49| **Yellow** | 25-50% | Reduce feature velocity, focus on reliability |50| **Red** | < 25% | Feature freeze, reliability work only |51| **Exhausted** | 0% | Emergency reliability sprint |5253### Burn Rate5455Rate at which error budget is consumed.5657- **Fast burn**: > 14x normal rate → Alert immediately58- **Slow burn**: 2-14x normal rate → Alert within 6 hours59- **Normal burn**: < 2x normal rate → Monitor6061## Alert Design Principles6263### Good Alerts6465✅ **Actionable** — Clear action to take when alert fires66✅ **Specific** — Precise condition, not vague "high CPU"67✅ **Not noisy** — Only alert on real issues, not transient spikes68✅ **Documented** — Runbook exists for every alert69✅ **Tested** — Alert has been tested and works7071### Bad Alerts7273❌ **Noisy** — Fires frequently without real issues74❌ **Vague** — "Something is wrong" without specifics75❌ **Non-actionable** — No clear remediation steps76❌ **Undocumented** — No runbook or context77❌ **Untested** — Never verified to work7879### Alert Severity8081- **Critical**: Immediate action required (SEV1)82- **Warning**: Action needed soon (SEV2)83- **Info**: Monitor, no immediate action (SEV3/SEV4)8485## Dashboard Design Guidelines8687### USE Method (Infrastructure)8889- **Utilization**: CPU, memory, disk, network90- **Saturation**: Queue depth, wait time91- **Errors**: Error rate, failed requests9293### RED Method (Services)9495- **Rate**: Requests per second96- **Errors**: Error rate97- **Duration**: Latency (P50, P95, P99)9899### Dashboard Best Practices100101- **Top-level**: Overall health, key SLIs102- **Drill-down**: Per-service, per-region views103- **Time ranges**: 1h, 6h, 24h, 7d, 30d104- **Annotations**: Deployments, incidents, changes105- **Alerts integration**: Show active alerts on dashboard106107## Capacity Planning Framework108109### Steps1101111. **Measure Current Usage**112 - CPU, memory, disk, network113 - Request rate, database connections114 - Storage growth rate1151162. **Forecast Demand**117 - Historical growth trends118 - Business projections119 - Seasonal patterns1201213. **Calculate Capacity Needs**122 - Headroom: 20-30% buffer123 - Growth: 3-6 month projection124 - Peak: Handle 2-3x normal load1251264. **Plan Scaling**127 - Horizontal: Add more instances128 - Vertical: Increase instance size129 - Auto-scaling: Configure triggers1301315. **Review Regularly**132 - Monthly capacity reviews133 - Adjust forecasts based on actuals134 - Update scaling policies135136### Capacity Planning Template137138```markdown139# Capacity Plan: {Service Name} — {Quarter}140141## Current State142- **Instances**: {Count}143- **CPU Usage**: {Average}% (Peak: {Peak}%)144- **Memory Usage**: {Average}% (Peak: {Peak}%)145- **Request Rate**: {RPS} (Peak: {Peak RPS})146147## Forecast148- **Growth Rate**: {X}% per month149- **Projected Load**: {Future RPS} in 3 months150- **Peak Multiplier**: {X}x normal load151152## Capacity Needs153- **Required Instances**: {Count}154- **Headroom**: {Percentage}%155- **Scaling Strategy**: {Horizontal/Vertical/Auto}156157## Action Items158- [ ] {Action} — Owner: {Name} — Due: {Date}159```160161## Monitoring Checklist162163- [ ] SLIs defined for all critical services164- [ ] SLOs set with business alignment165- [ ] Error budgets tracked and reviewed monthly166- [ ] Alerts configured and tested167- [ ] Dashboards created (USE/RED method)168- [ ] Runbooks written for all alerts169- [ ] Capacity planning done quarterly170- [ ] Monitoring coverage > 95% of critical paths