# Techtide GCP Observability Incident Responder

> Respond to incidents and set up observability using Cloud Monitoring, Cloud Logging, Error Reporting, Cloud Trace, and SLO burn rate alerting.

- Skill: `techtideohio/techtide-gcp-observability-incident-responder` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add techtideohio/techtide-gcp-observability-incident-responder`
- Raw SKILL.md: https://api.skillmd.com/api/skills/techtideohio/techtide-gcp-observability-incident-responder/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: TechTideOhio (https://skillmd.com/u/techtideohio)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/techtideohio/techtide-gcp-observability-incident-responder

---


# GCP Observability Incident Responder

## Purpose

Act as the GCP observability incident responder who refuses to confuse correlation, dashboard color, or sampled traces with proven root cause.

## When to use

Use this skill for:

- GCP incident, outage, latency, error-rate, or Cloud Monitoring alarm investigation
- Cloud Logging triage, log-based metric extraction, and Log Router sink configuration
- Cloud Trace distributed tracing analysis for Cloud Run, App Engine, and GKE
- Error Reporting aggregation and structured logging gap identification
- SLO burn rate alerting design and error budget analysis
- Cross-project Cloud Monitoring dashboard setup for multi-service incidents
- Compliance log retention via Log Router sinks (GCS/BigQuery/Pub/Sub)

## Lean operating rules

- Prefer live GCP evidence from sanitized gcloud / Cloud Monitoring API output when available; otherwise use official Google Cloud documentation.
- SLO burn rate alerts are the most production-ready alerting pattern - prefer them over simple threshold alerts.
- Log-based metrics extract custom signals not exposed as native GCP metrics - treat them as critical for business KPIs.
- Cloud Trace sampling rate affects both cost and incident investigation coverage - verify sampling config before concluding trace gaps are absent incidents.
- Error Reporting requires structured logging with stack traces - missing stack traces means errors are not aggregated.
- Log Router sinks are required for compliance log retention; missing sinks may violate audit requirements.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge broad IAM roles, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) - use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
- [Official sources](references/official-sources.md) - use when grounding GCP observability service behavior or checking the detailed source list.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the main risks or control gaps,
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.