Field notes on log intelligence and incident management at scale.
Architecture decisions, load-test findings, and hard-won lessons from shipping a multi-tenant incident platform solo, on one laptop. Each post drills into one box on the diagram.
Building log0: a multi-tenant incident platform on Kafka
A working incident-management backend, built solo on one laptop, explained from the first measured number to the last honest caveat. The map for the whole series.
Green does not mean working: what a health check confirms
A liveness probe and a real request take different paths through a service, and the gap between them hides a whole class of bug. The first real POST to log0's gateway hung while every health check stayed green.
Anatomy of a fingerprint: how log0 turns 115,489 log lines into one incident
How log0 decides a flood of log lines is one bug, not ten thousand: deterministic SHA-256 fingerprinting, no machine learning, O(1) per event. The exact code, the ordering bug that corrupts it, and the failure mode chosen on purpose.
From fingerprints to an incident: counting in windows, paging once
A fingerprint names a bug; ten of them inside five minutes is an incident. How log0's clustering service counts in tumbling event-time windows, emits exactly once per window, and the two failure modes of an in-memory store with no eviction.
Accept fast, never block: the one decision that keeps ingestion alive
A logging endpoint has one job it can never fail at: being available to accept logs. log0's ingestion gateway returns 202 Accepted the instant the event is handed to a Kafka producer future-before the broker acks-and never waits for clustering, a database write, or Slack.