$ guides ▌

OPERATIONS · INCIDENT-FIRST

Operations Guides

Production guides for engineers who get paged. What breaks first, which signals matter, how to move from symptom to root cause without guessing. We publish one technology at a time, each as a self-contained playbook.

Built for the technologies you actually run

Most monitoring content explains what a technology is. These guides explain how it actually fails.

Production systems break in patterns. The disk fills. The daemon wedges. The kernel kills a process the application thought it owned. Latency climbs while CPU graphs look fine. The same handful of failure modes show up across teams, across companies, across years.

Each section here is built around those patterns: a hub page that explains how the technology fails in production, plus focused runbooks for each common symptom. No fluff. No "what is a container" intros. Just the things you wish someone had written down before your last incident.

Sections

Each section is a self-contained operations playbook for one technology. Open one to dig in, or check what's coming next.

Available now

Docker

How Docker actually runs in production, where it tends to break, what to monitor as your operation matures, and runbooks for the failures you'll actually see.

Start with a common failure

Open the Docker playbook→

Available now

Kubernetes

How the control plane and node-side runtime actually behave in production, where clusters tend to break, and runbooks for the failures you'll actually see.

Start with a common failure

Open the Kubernetes playbook→

Available now

PostgreSQL

How the MVCC + WAL + autovacuum system actually behaves under load, where it tends to break, and runbooks for the connection, lock, vacuum, replication, and checkpoint failures you'll actually see.

Start with a common failure

Open the PostgreSQL playbook→

Available now

NGINX

How workers, connection slots, and upstreams actually behave under load, where NGINX tends to break, and runbooks for the connection, FD, backend-cascade, buffer, and TLS failures you'll actually see.

Start with a common failure

Open the NGINX playbook→

Available now

Redis

Fork/COW storms, event-loop wedge, replication backlog overflow, memory pressure spirals.

Start with a common failure

Open the Redis playbook→

Available now

Kafka

ISR shrinks, leaderless partitions, consumer lag, controller overload, broker disk exhaustion.

Start with a common failure

Open the Kafka playbook→

Available now

Elasticsearch

Heap pressure death spirals, unassigned shards, disk watermark cascades, mapping explosions, and the cluster-health states you'll actually debug.

Start with a common failure

Open the Elasticsearch playbook→

Available now

Network Monitoring

How an NPM pipeline actually behaves — SNMP polling, NetFlow/sFlow/IPFIX, BGP, traps, syslog, topology — where it silently loses data, and runbooks for the failures you'll actually see.

Start with a common failure

Open the Network Monitoring playbook→

Available now

MySQL

Connection exhaustion, redo-log and checkpoint stalls, lock and deadlock cascades, purge-lag explosions, metadata-lock pileups, and replication lag — the InnoDB failures you'll actually debug, with runbooks.

Start with a common failure

Open the MySQL playbook→

Available now

MongoDB

How the WiredTiger cache, oplog, and replica-set elections actually behave under load, where MongoDB tends to break, and runbooks for the cache-pressure, oplog-window-collapse, connection-storm, checkpoint-stall, and failover failures you'll actually see.

Start with a common failure

Open the MongoDB playbook→

Available now

ClickHouse

How the MergeTree engine, background merges, and Keeper-coordinated replication actually behave under load, where ClickHouse tends to break, and runbooks for the merge-debt, memory-limit, too-many-parts, and replication failures you'll actually see.

Start with a common failure

Open the ClickHouse playbook→

Available now

Cassandra

How the compaction and GC pipelines, tombstones, hints, and quorum actually behave under load, where Cassandra tends to break, and runbooks for the death-spiral, tombstone, disk-exhaustion, and node-down failures you'll actually see.

Start with a common failure

Open the Cassandra playbook→

Available now

CockroachDB

How ranges, Raft replication, the Pebble LSM engine, and node liveness actually behave under load, where CockroachDB tends to break, and runbooks for the compaction-spiral, write-stall, clock-skew, and range-unavailability failures you'll actually see.

Start with a common failure

Open the CockroachDB playbook→

Available now

RabbitMQ

How Erlang processes, the two resource alarms, and flow control actually behave under load, where RabbitMQ tends to break, and runbooks for the memory-alarm, disk-alarm, network-partition, flow-control, and connection-exhaustion failures you'll actually see.

Start with a common failure

Open the RabbitMQ playbook→

Available now

HAProxy

How frontends, backends, connection limits, and health checks actually behave under load, where HAProxy tends to break, and runbooks for the maxconn, queue-buildup, 5xx-attribution, health-check-cascade, and FD-exhaustion failures you'll actually see.

Start with a common failure

Open the HAProxy playbook→

Available now

Microsoft SQL Server

How the buffer pool, transaction log, TempDB, worker threads, and AlwaysOn replicas actually behave under load, where SQL Server tends to break, and runbooks for the log-full, memory-grant, worker-exhaustion, blocking-chain, and AG-desync failures you'll actually see.

Start with a common failure

Open the Microsoft SQL Server playbook→

Available now

ZooKeeper

How the quorum, the write pipeline, snapshots, and client sessions actually behave under load, where ZooKeeper tends to break, and runbooks for the quorum-loss, fsync-stall, GC-pause, session-expiry, and txnlog-disk-full failures you'll actually see.

Start with a common failure

Open the ZooKeeper playbook→

Available now

Ceph

How CRUSH placement, the OSD fleet, and the monitor quorum actually behave under load, where Ceph tends to break, and runbooks for the near-full/full-ratio stops, stuck and degraded PGs, slow requests, OSD flapping, and mon-quorum-loss failures you'll actually see.

Start with a common failure

Open the Ceph playbook→

Available now

VMware vSphere

How the ESXi scheduler, memory reclamation tiers, datastores, and the vCenter appliance actually behave under load, where vSphere tends to break, and runbooks for the CPU-ready, ballooning-and-swap, datastore-latency, snapshot, and vCenter certificate/disk-full failures you'll actually see.

Start with a common failure

Open the VMware vSphere playbook→

What's coming next

Content roadmap for upcoming sections. Each will follow the same incident-first structure: mental model, failure patterns, monitoring maturity, and runbooks.

Up next Oracle Database LGWR stalls, archive destination full, lock contention cascades, parse storms

Up next Tomcat Thread pool exhaustion, GC death spirals, classloader leaks on redeploy, stuck threads

Planned PHP-FPM Worker exhaustion, slow request cascades, memory creep, socket backlog overflow

Planned Memcached Evictions, hit-ratio collapse, connection exhaustion, restart data loss

Planned Consul Leader instability, gossip flapping, catalog bloat, blocking query buildup

Planned Envoy Connection pool exhaustion, xDS disconnects, retry amplification, stats cardinality explosions

Planned Traefik Backend health cascades, TLS certificate failures, middleware latency

Planned CoreDNS Upstream black holes, cache collapse, Kubernetes API disconnects, forwarding loops

Planned NATS Slow consumer cascades, JetStream Raft instability, silent message loss

Planned Fluentd Buffer saturation, retry storms, poison pill crash loops, silent data loss

Planned Logstash Pipeline backpressure, queue saturation, JVM heap pressure, dead-letter growth

Planned NVIDIA GPU VRAM exhaustion, thermal throttling, XID errors, GPU hangs, interconnect stragglers

Planned ZFS Pool degradation, capacity-fragmentation cliffs, TXG sync hangs, ARC starvation

Planned LVM Thin pool exhaustion, device loss, silent redundancy loss, snapshot collapse

Planned NVMe Critical warnings, media errors, endurance wear-out, controller failures

Planned S.M.A.R.T. disk health Media degradation, SSD wear-out cliffs, transport failures, thermal damage

Planned Apache HTTPD Worker exhaustion, listen queue overflow, slow backend cascades, log disk full

Planned Apache Pulsar Bookie journal latency, backlog growth, consumer health, metadata store latency

Planned ActiveMQ Memory pressure cascades, store exhaustion, poison message DLQ storms

Planned BIND DNS Recursive client exhaustion, cache pressure, UDP drops, zone staleness

Planned PgBouncer Pool exhaustion, client connection limits, backend unreachable, pool mode mismatch

Planned ProxySQL Backend connection starvation, multiplexing collapse, monitor false decisions

Planned Postfix Queue buildup, deferred storms, delivery latency, bounce floods

Planned uWSGI Worker exhaustion, harakiri storms, memory creep, reload failures

Planned Varnish Thread pool exhaustion, cache stampedes, ban list explosions, storage exhaustion