Monitoring answers whether something works. Observability answers why it does not. I write about strategies for collecting logs and metrics, about alerts that do not wake people up for no reason, and about the storage costs nobody thinks about at the start.
In a small team the first hour of an outage decides how long it lasts. A lead, a first message within 15 minutes, establishing scope, checking recent changes, and rolling back before looking for the cause.
A certificate’s expiry date is known from the day it is issued, and yet expired certificates keep stopping services. How to build an inventory from three sources, read the dates with commands and set alert thresholds matched to the renewal method.
Thousands of time series and two hundred notifications a day give zero answers and a team that has stopped reading the alert channel. A small set of signals, and alerts that each require action.
A central log system without a strategy becomes an expensive warehouse of noise. Which Windows events to collect, how to check that they are generated at all, how to filter and process them, and how long to keep them.