Tag: mttr

  • How to Alleviate Your Observability Challenges

    How to Alleviate Your Observability Challenges

    Observability is becoming a keystone of contemporary DevOps practices. Even departments that weren’t traditionally a part of DevOps are seeing the benefits of being brought under the auspices of observability teams. In 2023, however, organizations are finding that the road to adoption is bumpier than expected. Here are seven of the biggest challenges DevOps teams face with observability and some suggestions for mitigating them.

    Increasing MTTR

    MTTR, or mean time to recovery, is the time it takes to get a system back up and running after an outage or bug. A longer MTTR means more downtime and poorer service for clients. Worryingly, the DevOps Pulse Report indicates that the average MTTR is increasing. This year, 73% of its respondents reported an MTTR of multiple hours; last year’s figure was only 64%.

    MTTR often results from an inability to diagnose incidents due to data siloes impairing observability. This can be improved by an observability platform that allows engineers to see the big picture.

    Costs of Telemetry Data

    Along with increasing MTTR, many organizations have to deal with costs incurred by high telemetry data volumes. It’s a big problem. An IDC survey of 200 companies found that 53% of respondents highlighted the costs of storing log data.

    Much of the problem is due to an outmoded tiered pricing model. Many vendors charge per GB of data, so if your data volumes fluctuate, so will your data costs. They also have obscure pricing models, meaning many organizations find it difficult to know what they’re paying for. At Coralogix, we’ve created a new business model that is one-third of the cost of standard log storage solutions.

    Tool Sprawl

    To understand why this is a challenge, we need to answer the question: What is observability? Effective observability requires integrating data from every aspect of your application. Because many organizations implement monitoring with multiple tools, they suffer from tool sprawl. This has the effect of siloing telemetry data, making it harder to correlate data and extract insights into system performance.

    There are a range of options for mitigating tool sprawl, such as thoroughly evaluating a tool’s costs and benefits before including it in your DevOps strategy. The most effective solution is a “single pane of glass” tool that combines insights synoptically on a single dashboard.

    Kubernetes Complexity

    Elastic reports that organizations are increasingly turning to cloud-based solutions such as Kubernetes for their DevOps. Kubernetes can supercharge organizations with its ability to dynamically scale infrastructure as needed, eliminating the cost overheads of dedicated servers.

    However, Kubernetes is complex and comes with its own set of challenges. Kubernetes’ scalable architecture comes from containerization, a paradigm in which applications are hosted in objects called containers. This means that developing in Kubernetes requires the ability to work with a lot of spinning plates.

    A good way to combat this is better training in organizations. Additionally, breaking down silos allows different teams to transfer knowledge.

    Security Challenges

    Kubernetes’ popularity brings security challenges. These can include privilege escalation, where a user manages to gain privileges such as write access, and security misconfigurations, where developers forget to change the non-secure default configurations.

    There are several strategies for mitigating Kubernetes security risks. These include scoping roles to particular namespaces, using service meshes, and enhancing security with Coralogix’s Kubernetes Operator.

    Beyond Kubernetes, there’s the larger issue of integrating security into an observability strategy, which is becoming a challenge for an increasing number of IT businesses. To counter this, more and more businesses are starting to incorporate observability and security monitoring under a single umbrella. Solutions such as infrastructure and application metrics can enhance security and monitoring.

    Scaling Platforms

    To meet the challenges posed by rising data costs and increasing cloud complexity, businesses are turning to open-source solutions. These come with their own challenges, however. According to the DevOps Pulse Report, around 30% of enterprises surveyed had problems with infrastructure management, scaling and upgrading relevant components. Because many open-source platforms require specialized knowledge to maintain, businesses have trouble sourcing the skills and expertise for them.

    Tools such as OpenTelemetry can make scaling easier by integrating with platforms such as Coralogix.

    Troubleshooting Data Pipeline Performance

    Implementing observability requires having a reliable and high-performance pipeline for telemetry data. However, organizations using open-source platforms often have trouble monitoring and troubleshooting the performance of their data pipeline. This can impair observability as telemetry data is of lower quality.

    Data engineer Abraham Alcantara suggests ten key steps to troubleshoot data pipelines successfully. These include identifying data pipeline software and infrastructure, reproducing and isolating issues and automating issue scenarios. Another strategy is to apply machine learning, such as Coralogix uses.

  • Using Generative AI for Issue Remediation and Software Reliability

    Using Generative AI for Issue Remediation and Software Reliability

    In today’s fast-paced digital landscape, keeping your services up and performant, especially for cloud-based and online services, is crucial for staying competitive. Downtime or latency issues can drive customers away, especially when all it takes is a click to switch over to a competing SaaS solution. DevOps and site reliability engineering (SRE) teams face the constant challenge of minimizing mean-time-to-remediation (MTTR) when dealing with errors and issues. As valuable as search engines like Google are, the sheer amount of information available can make finding the right solutions a time-consuming task. What if there was a way to automate and streamline this process, making error investigation more intelligent, focused and efficient?

    This article will walk you through the journey of error resolution from the first obscure log line to identifying the problem hidden within it. We’ll resolve the issue using several tactics, ultimately leading to the use of generative AI to cut MTTR and provide precise IT recommendations. This journey includes useful measures and principles that can be applied by DevOps teams and explores the potential for applying generative AI.

    The Current Experience of DevOps/SRE

    Picture this: A log line pops up with an obscure error message, and the first instinct is to search for this message on Google for potential solutions. After all, someone else must have encountered a similar problem, right? However, the abundance of resources and search results can be overwhelming. The search results are often displayed based on website relevance, not necessarily the relevance of the error itself. Consequently, precious time is wasted sifting through countless search results, leading to a longer time to understand and remediate the error. For DevOps and SRE teams responsible for maintaining system stability, reducing MTTR is a crucial key performance indicator (KPI). This begs the question: How can we leverage automation and artificial intelligence to improve the search process and accelerate error resolution?

    Our First Step: Cognitive Insights

    In our organization’s initial attempt to tackle this challenge, we focused on leveraging crowdsourcing techniques to get more relevant results than the brute-force Google search. Moreover, we wanted to automate the process and run it offline so that when an incident occurs, we can offer useful insights rather than starting the search as the system is down or malfunctioning.

    The approach involves an offline phase and an online phase. The offline phase involved analyzing all our ingested logs and identifying common log patterns. This also allowed us to count how often this pattern occurred in our system and how prevalent it is. Then we crawled relevant technology forums like StackOverflow, Google Groups and Bing Groups for relevant discourse around these log patterns that could offer relevant solutions. The next step was to rank the search results by relevance and take the top five most relevant links.

    The offline phase resulted in a library of known log patterns and, for each one, a cognitive insight containing these links, as well as additional information such as the severity level, how many times this pattern occurred in the logs, the date of first occurrence and additional tags of involved technologies, tools and domains.

    The online phase occurs in real-time as new logs come in. Upon ingesting the log, it is automatically matched against all known patterns; if it matches one, it gets the cognitive insight for that pattern. This means that as soon as the problematic log comes in, the DevOps engineer already has focused and ranked search results and context to start from, which accelerates the investigation process.

    The Next Step: Why Don’t we ask Generative AI?

    After reflecting on our initial approach, we had an epiphany. Large language models (LLMs) like ChatGPT had already crawled the web and absorbed a vast amount of information. So, why not leverage their capabilities and ask them directly for insights? The idea was simple: Let the AI “read the posts” for us and provide us with recommendations. We started by formulating specific questions such as “What could the possible errors be?” and even went a step further by asking for further investigation steps. However, implementing this seemingly straightforward approach came with its own set of challenges. We needed to run preprocessing before asking the generative AI, as well as running post-processing on the answers it returned, to get what we expected. Let’s see what that process entails.

    How we Did It: Analyzing, Sanitizing and Validating

    Before asking ChatGPT (or any other generative AI tool) for assistance, several preparatory steps were necessary. First, we had to analyze incoming logs, identify patterns and score them based on severity. This allowed us to prioritize the most critical issues.

    Secondly, we had to carefully design our prompts for the generative AI using prompt engineering, ensuring that we framed our questions in a way that yielded precise and relevant responses. Prompt engineering is the practice of strategically designing effective prompts or instructions for language models to achieve more accurate responses. It involves carefully specifying the input format, context or constraints to guide the model’s generation process and obtain more accurate and desired results. This is true for any use of generative AI, and for our case in particular. Beyond accuracy, prompt engineering helped us tune the requested format and length of the answer to fit the “executive summary” paragraph we popped up for the user. This ensured it wasn’t too lengthy nor too short to provide meaningful insights.

    Additionally, we took great care in sanitizing the queries and removing any sensitive data to maintain privacy and security. This step was especially crucial for those working with public services, highlighting the importance of protecting users’ personally identifiable information (PII), such as names, emails, phone numbers, IP addresses or GPS coordinates.

    With all this preprocessing done, we sent the prompt to the generative AI. It is important to note that public services may not always be available (as some returned a “service is busy” message when working with ChatGPT and other services), so automation should take care of delays and employ retries as needed.

    Finally, as responses were received from the AI, it was essential to validate those. We ran an analysis and filtered out non-relevant answers from different domains (after all, a log is also a product of a tree, and Kafka is also a novelist), ensuring there was no offensive content or misleading information. The semantic integrity of the responses was also carefully evaluated.

    These AI insights have proven to be a powerful troubleshooting tool, and we’ve made it an integral part of our service.

    This journey is not unique. In fact, DevOps teams can employ similar measures for their own telemetry data to serve their own operational workflows. These principles, such as data sanitization and validation, even apply to other types of data and use cases.

  • CircleCI Report Surfaces DevOps Productivity Gains

    An analysis of more than 14 million workflows from thousands of organizations conducted by CircleCI, a provider of a continuous integration/continuous delivery (CI/CD) platform, revealed the mean-time-to-recovery (MTTR) decreased by about 13% year-over-year.

    Half of CI workflows (50%) recovered from a failed run in 64 minutes or less. That compares to 73 minutes or more in previous years, the report noted.

    In general, the report found 50% of workflows completed in 3.3 minutes or less. However, the average duration was approximately 11 minutes. The median workflow ran 1.54 times per day.

    Success rates, as defined by the number of passing runs divided by the total number of runs, was, on average, 77% for default branches and 67%, on average, for non-default branches.

    Naturally, the level of productivity any given DevOps team can achieve is impacted by everything from the size of the team to the vertical industry they operate in. CircleCI CTO Rob Zuber also noted there are other crucial developer productivity metrics, such as the amount of time developers are focused on writing code, that need to be tracked as well.

    The goal for any DevOps team is to abstract away as much complexity as possible to enable developers to spend more time on writing business logic, said Zuber. Unfortunately, as more responsibility for infrastructure and security has shifted left toward developers, many of them are spending too much time managing application environments instead of writing code, noted Zuber. He noted that the cognitive load being placed on developers today is too high.

    Developing applications is, of course, as much an art as it is a science. Organizations can set aside time for sprints to write code, but it’s difficult to dictate when inspiration might strike a particular developer. There is always going to be a need to let developers, for example, write code at odd hours of the day and night. The more friction they encounter in terms of spinning up application environments, the less likely it becomes a developer will spend time squarely focused on writing code, said Zuber. The “zone” is when most of the best code is developed, he added.

    Naturally, there is no set of metrics that are equally applicable to all DevOps teams, but they should pay attention to metrics as an indicator of whether teams are improving, added Zuber. Most developers and software engineers are not going to want to work in a “software factory” where every minute of the day needs to be accounted for within a project management application. Rather than employing metrics as a stick, they should instead be used as an educational tool—a carrot—that drives steady improvement. In addition, organizations should take care to make sure the collecting of metrics doesn’t impede the pace at which applications are being developed.

    As the saying goes, things measured are usually things done; but there is a fine line to be observed when it comes to any goal that requires a certain level of creativity to achieve.

  • Best of 2022: How DORA Metrics Can Measure and Improve Performance

    Best of 2022: How DORA Metrics Can Measure and Improve Performance

    As we close out 2022, we at devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

    A technology company’s most valuable assets are its people and data, especially data about the organization itself. By knowing what data to track over time, engineering leaders can measure how efficiently their DevOps teams are operating and enable them to maximize their value stream to deliver the best possible product to end users.

    After years of research, Google’s DevOps Research and Assessment (DORA) team identified four key metrics for evaluating a team’s performance:

    1. Lead time for changes
    2. Deployment frequency
    3. Mean time to recovery
    4. Change failure rate

    DORA metrics have now become the standard for gauging the efficacy of software development teams and can provide crucial insights into areas for growth. These metrics are essential for organizations looking to modernize and those looking to gain an edge against competitors. Below, we’ll dive into each metric and discuss what they can reveal about development teams.

    Lead Time for Changes

    Lead time for changes (LTC) is the time between a commit and production. LTC indicates how agile a team is—it not only tells you how long it takes to implement changes but how responsive the team is to the ever-evolving demands and needs of users. The DORA team identified these benchmarks for performance in their Accelerate State of DevOps 2021 report:

    Elite performers: Less than one hour

    High performers: One day to one week

    Medium performers: One month to six months

    Low performers: More than six months

    LTC can reveal symptoms of poor DevOps practices: If it takes teams weeks or months to release code into production, there are inefficiencies in their process. One can minimize their LTC through continuous integration and continuous delivery (CI/CD). Encourage testers and developers to work closely together so everyone has a comprehensive understanding of the software. Consider building automated tests to save more time and improve the CI/CD pipeline.

    Because there are several phases between the initiation and deployment of a change, it’s wise to define each step of the process and track how long each takes. Examine the cycle time for a thorough picture of how the team functions and further insight into where they can save time.

    One should be careful not to let the quality of their software delivery suffer in a quest for faster changes. While a low LTC may indicate that a team is efficient, if they can’t support the changes they’re implementing or they’re moving at an unsustainable pace, they risk sacrificing the user experience. Rather than compare the team’s Lead Time for Changes to other teams’ or organizations’ LTC, one should evaluate this metric over time and consider it an indication of growth (or stagnancy).

    Deployment Frequency

    Deployment frequency (DF) is how often you ship changes; how consistent your software delivery is. This metric is beneficial when determining whether a team is meeting goals for continuous delivery. According to the DORA team, these are the benchmarks for Deployment Frequency:

    Elite performers: Multiple times a day

    High performers: Once a week to once a month

    Medium performers: Once a month to once every six months

    Low performers: Less than once every six months

    The best way to enhance DF is to ship a bunch of small changes, which has a few upsides. If deployment frequency is high, it might reveal bottlenecks in the development process or indicate that projects are too complex. Shipping often means the team is constantly perfecting their service and, if there is a problem with the code, it’s easier to find and remedy the issue.

    If a team is large, this may not be a feasible option. Instead, one may consider building release trains and shipping at regular intervals. This approach will allow the team to deploy more often without overwhelming your team members.

    Mean Time to Recovery

    Mean time to recovery (MTTR) is the average amount of time it takes your team to restore service when there’s a disruption like an outage. This metric offers a look into the stability of your software, as well as the agility of your team in the face of a challenge. These are the benchmarks identified in the State of DevOps report:

    Elite performers: Less than one hour

    High performers: Less than one day

    Medium performers: One day to one week

    Low performers: Over six months

    To minimize the impact of degraded service on your value stream, there should be as little downtime as possible. If it’s taking your team more than a day to restore services, you should consider utilizing feature flags so you can quickly disable a change without causing too much disruption. If you ship in small batches, it should also be easier to discover and resolve problems.

    Although mean time to discover (MTTD) is different from mean time to recovery, the amount of time it takes your team to detect an issue will impact your MTTR—the faster your team can spot an issue, the more quickly service can be restored.

    As with lead time for changes, you don’t want to implement sudden changes at the expense of a quality solution. Rather than deploy a quick fix, make sure that the change you’re shipping is durable and comprehensive. You should track MTTR over time to see how your team is improving and aim for steady, stable growth.

    Change Failure Rate

    Change failure rate (CFR) is the percentage of releases that result in downtime, degraded service or rollbacks, which can tell you how effective a team is at implementing changes. As you can see, there is not much distinction between performance benchmarks for CFR:

    Elite performers: 0-15%

    High, medium and low Performers: 16-30%

    Change Failure Rate is a particularly valuable metric because it can prevent a team from being misled by the total number of failures they encounter. Teams who aren’t implementing many changes will see fewer failures, but that doesn’t necessarily mean they’re more successful with the changes they do deploy. Those following CI/CD practices may see a higher number of failures, but if CFR is low, these teams will have an edge because of the speed of their deployments and their overall success rate.

    This rate can also have significant implications for the value stream: It can indicate how much time is spent remedying problems instead of developing new projects. Because high, medium and low performers all fall within the same range, it’s best to set goals based on the team and the particular business rather than compare to other organizations.

    Putting it All Together With DORA Metrics

    As with any data, DORA metrics need context, and one should consider the story that all four of these metrics tell together. Lead time for changes and deployment frequency provide insight into the velocity of a team and how quickly they respond to the ever-changing needs of users. On the other hand, mean time to recovery and change failure rate indicate the stability of a service and how responsive the team is to service outages or failures.

    By comparing all four key metrics, one can evaluate how well their organization balances speed and stability. If the LTC is within a week with weekly deployments but the change failure rate is high, then teams may be rushing out changes before they’re ready, or they may not be able to support the changes they’re deploying. If they are deploying once a month, on the other hand, and their MTTR and CFR are high, then the team may be spending more time correcting code than improving the product.

    Because DORA metrics provide a high-level view of a team’s performance, they can be beneficial for organizations trying to modernize—DORA metrics can help identify exactly where and how to improve. Over time, teams can measure where they have grown and which areas have stagnated.

    Those who fall into the elite categories can leverage DORA metrics to continue improving services and gain an edge over competitors. As the State of DevOps report reveals, the group of elite performers is rapidly growing (from 7% in 2018 to 26% in 2021), so DORA metrics can provide valuable insights for this group.

    But remember that data will only get you so far. To get the most out of DORA metrics, engineering leads must know their organization and teams and harness that knowledge to guide their goals and determine how to effectively invest their resources.

  • Why MTTR is a Vital Metric for DevOps Teams

    Why MTTR is a Vital Metric for DevOps Teams

    In DevOps, every second counts. System failures mean your engineers lose valuable time improving software and developing new features. So how do you effectively detect and manage these issues? Mean-time-to-resolve (MTTR) can provide insight into how effectively your DevOps team responds to incidents and how reliable your software is. It’s difficult to know how your team can improve or determine a performance baseline if you don’t have data to analyze your incident management workflows. In this article, you will learn about this valuable metric, interpret it and leverage this information to minimize downtime.

    Why MTTR Matters

    Whether you’re a legacy organization striving to modernize, a startup looking to gain an edge or somewhere in between, MTTR is a vital metric for your organization. It can indicate whether your processes are standardized and can highlight crucial areas for optimization. Most importantly, mean-time-to-resolve provides insight into how stable your software is and how responsive your team is over time.

    Mean-Time-to-Resolve and How to Interpret it

    MTTR can stand for many different things: Mean-time-to-repair, mean-time-to-recovery, mean-time-to-restore or mean-time-to-resolution are just a few interpretations of this versatile acronym. Each of these metrics examines a different aspect of addressing an incident. For example, mean-time-to-repair is the average time it takes engineers to fix a problem, calculated from the moment they begin to the moment a change is pushed to production. But this metric does not account for the amount of time between when an alert comes in and when work begins.

    Mean-time-to-resolution is the most high-level of these metrics—it considers the average time from when an alert comes in until the incident has been resolved, including postmortems and implementing process changes to avoid the same issue in the future. While the standards for this metric can vary by industry, the highest-performing DevOps teams see an MTTR of less than one day.

    Because it is such a comprehensive metric, a high mean-time-to-resolve measurement might indicate problems with alerting or that your engineers are spending a lot of time on repairs. Therefore, it’s essential to look at MTTR over time and analyze each component of your incident management workflow: Time to alert engineers, diagnose the issue, test fixes, ship to production, conduct reviews and learn from the incident.

    It may also be helpful to examine mean-time-to-resolve in conjunction with other metrics. To determine if your DevOps team is facing production challenges, evaluate your change failure rate (CFR) to see how many releases result in a downgraded service. Other DORA metrics, like deployment frequency and lead-time-to-changes, are perfect companions for mean-time-to-resolve.

    To establish the reliability of your software, you can look at mean-time-to-resolve beside mean-time-between-failures (MTBF), which calculates the average amount of time between incidents. If you’re updating your software often, compare mean-time-to-resolve with mean-time-to-failure (MTTF), which measures its duration before a program needs to be redesigned for functionality. To gain insight into your alerting processes, examine mean-time-to-detect (MTTD), which evaluates the time it takes your team to recognize that an issue exists.

    How to Improve Mean-Time-to-Resolve

    Alerting is the first stage of responding to an incident and should be one of the first areas to target when working to reduce mean-time-to-resolve. Ensure alerts are actionable and that DevOps team members have the tools they need to respond immediately. A straightforward escalation process is essential: Define responsibilities for each member and train the team in one another’s roles so that the process never grinds to a halt if someone is unavailable.

    Preemptive monitoring can help you get ahead of problems before they arise—by proactively checking for potential incidents, you can avoid unexpected downtime.

    The best way to improve MTTR is to standardize your operating procedures with runbooks. Without runbooks, DevOps teams have to respond without a clear direction and spend time messaging one another for information—they can’t act immediately. With runbooks, however, your organization’s knowledge base is centralized and accessible to all team members, enabling them to respond as soon as an issue comes up.

    If you’re already using runbooks, consider automating responses. Automation not only improves your mean-time-to-resolve but will give your DevOps team more time to devote to implementing long-term changes that improve the stability of your service.

    When implemented correctly, mean-time-to-resolve is a proven metric that can indicate how effective your DevOps team responds to challenges and how reliable your software is. But be careful not to incentivize the wrong behavior in a quest to minimize this metric. You could, for example, quickly reduce MTTR by eliminating all alerting protocols, but that would also mean poor service for your end users and likely result in poor team morale. Examine this metric over time and aim for slow and steady growth rather than a quick fix.

  • What Does Observability Mean to You and How Does it Scale? – Observability at Scale TV EP 1

    What Does Observability Mean to You and How Does it Scale? – Observability at Scale TV EP 1

    Observability is evolving quickly as a concept and practice, but what does observability really mean to you and your organization? For many DevOps teams it’s all about speeding MTTR across complex infrastructure and applications. For others, the notion of observability-driven development is being embraced as a strategic business initiative tied to customer success. Where does your team stand in this process, and what are the keys to successfully scaling observability to meet your specific requirements? Join us for this thought leadership discussion. What does observability mean to you, and how does it scale? Alan Shimel is joined by Mitch Ashley, Tomer Levy, co-founder and CEO of Logz.io, Helen Beal of DevOps Institute and Brian Dawson of Linux Foundation. The video and a transcript of the conversation are below.

    Alan Shimel: Hey, everyone, I’m Alan Shimel, CEO of MediaOps, devopsy.kinsta.cloud, Security Boulevard, Container Journal, and TechStrong TV. Welcome to a new series that we’re launching here on TechStrong called “Observability at Scale.” I’m really excited to launch this particular series, because to me, it deals with one of the, you know, one of the biggest issues, I think, facing dev ops, SREs, development teams, IT teams, in general, today. And that is what we call observability. Now, yes, ten different people, you’re gonna get ten different definitions of what observability is, and that’s kind of a double-edged sword, it’s a good thing and a bad thing, much like, there was no official definition of dev ops. However, it’s too big, no pun intended, too big an issue, too big a topic for us not to really be able to put our finger on.

    And especially as it continues to scale, because scale is probably the biggest issue around observability. But before we jump into all of this, we’ve assembled what I think is an amazing panel for this first show, and I’m gonna introduce them to you here in just a moment. Before we do, I wanted to give a big shout-out to our friends at Logz.io who are sponsoring this series and making it happen. You know, we need to pay the bills, here, and we can’t do it without sponsors, so many thanks to our friends at Logz.io. Let me now introduce you to our panel. I’m gonna start off with my friend Brian Dawson. Brian’s a frequent contributor to TechStrong TV, has been for years, but I’m gonna let him kind of introduce himself. Brian, say hello.

    Brian Dawson: Hello, Alan. Thanks for having me on. I’m Brian Dawson. I currently am the vice-president of developer relations and ecosystem development at the Linux Foundation. I came here by way of, ah, god, I hate to say _____, a multidecade career in software, as a software professional. Starting with Console Game Development, where we launched the PlayStation, but I spent about the past decade with a focus on optimizing software development and delivery via CICD and dev ops practices.

    Alan Shimel: Fantastic. Thanks, Brian. Next up is our friend, the chief ambassador of the DevOps Institute [laughs], Helen Beal. Helen, welcome.

    Helen Beal: It’s lovely to be here. Thank you, as always for the invitation. As you just said, I am chief ambassador of DevOps Institute. I’m also chair of the Value Stream Management Consortium. I came to all of this via many, many years of being in dev ops in ways of working culture, mainly, in Europe, as you can probably tell from the accent. I’m also, bizarrely, quite a lot in the Middle East, as well. And, yeah, delighted to be here amongst lots of people _____ _____ _____.

    Alan Shimel: Very good, pleasure to have you, Helen. I didn’t recognize any accent. [Laughs] Our third panel member is Tomer Levy – if I mispronounced it, I know it’s Levy, Tomer? Or how do you pronounce Levy? Levy?

    Tomer Levy: Levy, Levy, anything goes, Alan, for you, whatever you want.

    Alan Shimel: Well, no, in New York, we say Levy, but I know in other parts of the world, it’s Levy, so. Anyway, Tomer is CEO, right, of Logz.io, but why don’t you give’em your background, Tomer.

    Tomer Levy: No, absolutely, Alan, thank you, this is an exciting show. I’m Tomer Levy – that’s how I say it. You have to guess where the accent is from, but I’ll leave it to you guys to guess. If you say which accent [crosstalk].

    Alan Shimel: Mm-hmm, what accent?

    Tomer Levy: Exactly, what accent, exactly. Good, so I’m Tomer, I’m the CEO, one of the founders of Logz.io. We’re a cloud observability company, you know, hence the discussion and hence why we’re so excited about this topic. For me personally, I live in Israel, so that’s the accent. I am a second-time founder; I built a company before Logz.io. This company was around containers and, you know, a little bit before _____, we built a really cool container technology, and observability was a huge challenge. And when I moved to my next role, I said, you know, “How am I going to solve this?” and one day I saw this amazing opensource and I said, “I am going to make sure every developer in the world can use this opensource the same way I wanted to use it but could never do it. I had to use other tools _____ _____ which I didn’t like so much. So this is where I’m coming from, this is why I’m passionate about it, and I’m looking forward to this discussion.

    Alan Shimel: Fantastic and welcome, and thank you for the sponsorship. Last but not least is my cohost of the show along with me, and it’s my friend Mitchell Ashley. Mitch, why don’t you introduce yourself.

    Mitchell Ashley: Always good to be here and always good to be amongst friends. Thank you, everyone, for joining. My name is Mitch Ashley. I’m CEO of Accelerated Strategies Group, which is _____ _____ firm that’s focused on dev ops, cloud-native, cybersecurity, digital transformation. And I’m also CTO of MediaOps, where I work very closely with Alan and team, and appear on TechStrong TV on a number of areas. I’m both a product creator as well as a practitioner, CIO, kinda lived with it, so, implemented dev ops on IT teams and on product teams. So, I know the observability challenges well. [Laughs]

    Alan Shimel: Absolutely. Thanks, and thanks for joining us, Mitchell. So, guys, as I mentioned, this is our first show in this series, and I think though we wanna get to the issue of scale, I think before we get to the issue of scale, we need to first define observability. We were talking off-camera, and Helen mentioned that they were chopping down a tree in front of her house out there in the UK, and was it interfering, did anyone hear it, was it a lot of noise. None of us heard it. So of course the issue raised, if no one hears the tree being chopped down at Helen’s house, has it really been chopped down. And, you know, I guess it’s a question of what we observe and what does observability show us.

    But that’s not a great definition of observability. I’d like to – who wants to take a first crack and kind of saying, “Well, what exactly do we mean when we say ‘observability’?” Now, Tomer, I don’t wanna put any pressure on you, but you’re the CEO of the observability company, here, so, I’m gonna ask you to kick us off on that, and then Brian and Helen and Mitchell and I can jump in.

    Tomer Levy: No, for sure, I mean, you know, it’s a good question, how do you define, because people define it as signals, they tell you what the software is doing, and it’s all true. For me, it’s Mitch without glasses is when you don’t observability, right? You take your glasses off and you’re half-blind, right? So, I know you can see well, but for me, it’s these new glasses that you look into software, right, software is there to run a business. It’s e-commerce, it’s gaming, whatever it is, if you have glasses which are really, really good, I imagine, like, you put it on and you see these, you know, especially with _____ architecture, like, hundreds of different cogs moving around. And just to find this one place where the cog is stuck or something in your business is failing, these are the glasses.

    And people need these glasses today more than ever, right, with microservices, with modern architecture, with cloud, there are so many moving cogs, and observability, for me, is just a way to understand how is your business performing on a technical level. And because if some tree fell down inside your, you know, operation, no one cares, but if it impacts the business, then it’s important. That would be my definition.

    Alan Shimel: I think that’s a good one. Helen, Brian, interested in [crosstalk]?

    Helen Beal: [Crosstalk], for me, it’s a characteristic of a system that needs to be instrumented into a system, so I kind of go back to the mechanical engineering roots of it and the control theory. Also, with my dev ops background _____ _____ _____ it’s telemetry everywhere, so, this idea that everything is emitting lots of data, but with observability, I think it’s a more conscious effort in terms of what we’re instrumenting, what data we’re looking to emit. And then, the monitoring part is what we do when we observe our observable system. So, slightly different view, but I think we’re all trying to achieve the goals with this. Brian?

    Brian Dawson: Yeah, well, and I think a key part of the sort of traditional control theory around observability is this concept that I can derive or identify the state of a system based on observing outputs. And I was thinking about it earlier, and seeing it as akin to these Ring cameras that everybody has, right. And, you know, initially, it’s just put up a video camera, see what’s going on around my home. That itself does not provide me, necessarily, with observability. I can observe an aspect, but now imagine, as I start to get 360 cameras around my house, and water sensors, and a smart thermostat, right, I’m establishing a number of outputs that allow me to observe the state of my home: is it empty, is somebody approaching it, what is the temperature. Then I think another layer is when we talk about integrating and extending it to provide for action, right? So when we look at another layer of observability that we get with modern smart home systems is I can not only observe that it’s too hot, but I can respond and quickly resolve that issue to bring my home, the system, into a state that I’d like it to be in.

    Alan Shimel: Fair, good stuff. So, here’s my issue, right, I consider myself a businessperson, right? I know a lot about technology, but I’m not a developer, I’m not an SRE. Truth be told, I’m a half-assed security person, even. [Laughs] But I know enough about this stuff to be dangerous, right? And if I can’t understand what it is that something’s supposed to do and put my finger on it, it’s very hard for me. For our audience out here, guys, right, where does the rubber meet the road on observability?

    Helen Beal: [Crosstalk] start with a crack on that one. 

    Alan Shimel: Go ahead, go ahead. [Laughter]

    Helen Beal: So, we are in a digitally disrupted world, so most organizations are trying to transform to take advantage of the opportunities that the Internet provides us, and that means that they need to leverage a couple of things. They need to leverage dev ops and they need to leverage cloud. Once they start leveraging cloud, they create distributed systems, so we’re moving _____ _____ to microservices to a much more complex environment. So this is one of the issues of scale. I think we’re gonna talk about a different issue of scale, as well. But once we’ve got those microservices environments, we can then apply dev ops principles, because we’re able to build, test, and deploy in very small pieces, so we can go much faster. But there’s always a tradeoff, right, and the tradeoff here is that we’ve now got thousands, maybe even more than thousands, tens of thousands, millions, perhaps, of little bits of things, microservices that we need to manage.

    And therein lies the problem, that now all our traditional monitoring systems don’t really work, because we’ve got all this other stuff to look at. And then, from the business perspective, okay, it’s complicated, but why is it a real problem? Well, it’s a problem when something breaks, ’cause if something breaks, it’s unplanned work, and if we’re doing unplanned work, that means we’re not doing the planned work we want to do, so we’re not innovating. So if we can fix the problems around unplanned work, we are able to become a higher-performing organization, because we are able to deliver more value to our customers. We can, you know, spend more time on technical _____, we can spend more time learning, and become a dynamic learning organization and take that way.

    There’s a whole other bunch of use cases, by the way, around observability, that aren’t about debugging and instant management, which we’ll probably come to, as well. But that’s my view on why this is important and people should be trying to invest in building an observability culture and figuring out what tools they need to implement to support that goal.

    Mitchell Ashley: And I’m gonna really build on that. Helen, I very much agree that it’s, our software architecture is cloud-native, that initially sort of kicked off the observability, how do I manage thousands, maybe millions of bits _____ objects containers with code in it. I think it’s, observability, to me, is sort of an onion, and, yes, it’s managing the complexity of our software architectures like cloud-native, but it’s a lot more than that, ’cause we have infrastructures code, we have multi-cloud, we have distributed applications, we have dynamic environments where software is ephemeral. Those clusters may be running containers _____ _____ now gone, and another five seconds later, how do we know what happened. _____ _____ _____ to get back to Brian’s point about what was the state of something that might have caused an error, so we can get to root cause analysis very quickly. I think, ultimately, to Helen’s point, also, is it’s our ability to operate at speed, just like we can develop software at speed. ‘Cause if we can’t operate it at speed, you know, all we’re doing is building really fast cars and smashing into brick walls. That’s not fun for anybody. [Laughs] So I think that’s what really, you know, if I had to kind of say, I think the most important thing that observability has to do is match and support the pace of the business, and at the _____ _____ rate, as well as the rate we create software.

    Tomer Levy: Yeah, Mitch, I completely agree. If I can piggyback on that, you know, companies today cannot compete if you’re not delivering code fast to production, if you’re not delivering changes, you’re just gonna lose. So there is this tension of, “I have to deploy fast, I need to make my engineering team independent, not fearful of making changes,” whether I’m a Pizza Hut or I’m a Walmart, I have to go [snaps] really fast. And on the other side of it, more and more portions of your business relies, you know, on online to work well. So if you deploy really fast [snaps], you might break the entire business. So there’s enormous risk and enormous opportunity, and I think, in a way, observability is that bridge that connects the risk and the opportunity, right? Because if you have an amazing level of visibility with these glasses, that see the microservices, that see all this complexity, and tell you, “Hey, you just broke something, but you can fix it in 60 seconds before anyone knows.”

    And then, it’s amazing, and this is where it works amazingly well and it’s really hard to get there, it’s an ongoing challenge, because the complexity explodes, Helen, as you said, microservices, serverless, this enormous amount of data and telemetry is just, it becomes a huge data problem rather than – you know, and someone really smart comes and tries to search the metrics _____ _____ _____ it’s really, it’s more of a machine problem than a human problem, and this is where I think the world is going to.

    Brian Dawson: Well, you know, and I’d love to add, I really actually see observability, and speaking as somebody that has asked people, oftentime, “What’s the difference between observability and monitoring?” you know, that said, as my understanding progressed, which I’d love for somebody to comment on, I’ve really started to get bought into the fact that observability is a key manifestation of the contract between dev and ops that a dev ops culture looks to drive or speak to, right. We have tooling technology, at another level process and practice, and also maybe we can talk about kind of the culture around observability. But effectively, building a real communication stream to manifest the construct between developer and operations, that enables us to move fast, right, and all have sort of a shared set of data.

    Helen Beal: I think that’s a really important point that you’re making, as well, that the observability isn’t just for IT ops. It’s for everybody in the value stream, so we have ODD for developers, we have the concept we’re testing, that testability is equivalent _____ _____ to observability. We have people like product owners that will understand about the value, which is a slightly use case that I kind of alluded to earlier, and that observability allows us to understand whether our system’s working, but it also allows us to understand customer behavior, which is a very kind of interesting value realization use case. So, yeah, I completely agree, observability is a culture for everybody to be involved in.

    Alan Shimel: Agreed. So, Brian, you opened a can of worms for me [crosstalk].

    Brian Dawson: Good, I like to do that, you’re welcome.

    Alan Shimel: Yeah, again, you know, we look at it from a business point of view, when I first started devopsy.kinsta.cloud, right, one of the important things was APM, right? App Dynamics was a big dev ops company, and they were all about APM. And then, good friend of mine, Dave Link, the CEO at Science Logic said, “Nah, APM – ” he told me, one day, “Alan, APM’s done. It’s AI ops. AI ops is what it’s about, right, and that’s replacing APM.” And, you know, and we’ve had this evolution of names and, you know, three-letter acronyms to describe, as Brian says, that intersection of dev and ops, to describe what to me is to observe, right? To observe and then to act on the data that, you know, the data stream that I’m getting from my applications, from the software I’m developing.

    So to me, at a very elementary level, that’s observability. I’m not sure where it fits in, though, to monitoring and performance management, and AI ops, and all of these things. Is observability the replacement term and the replacement for all of these things [crosstalk] something different? Yeah, is it an umbrella or is it –

    Brian Dawson: I think that’s a good discussion, you know, what is it, is it a component of it? Is it now an umbrella term, for all of the types of monitoring kind of activities, data [crosstalk]?

    Helen Beal: [Crosstalk] I was just gonna say, so one of our other work family, if you like, Eveline Oehrlich, who’s actually the research officer at DevOps Institute, she also does research and research in action. She recently delivered a new vendor matrix to the market, which was virtually an AI ops matrix, and it became an AIPA, so, a predictive analytics. So she’s looking to rename this whole market. And if you take a close look at the report, you’ll see she’s got an evolution curve. She goes from APM through AI ops and up into observability, so, she’s definitely heading in that direction. And some of the reasons that she wanted to move from AI ops to AIPA is that she sees these other use cases. So she’s seeing that there isn’t just instant management; _____ is customer experience and lots of other things, that aren’t just to do whether a system is performing properly.

    I think some of the movement from APM is that, when we think about observability, it isn’t just about the application; it is about the infrastructure and the network, as well. So it’s kind of like everything in the observability bucket, if you like. Just one more note on the predictive analytics that might be worth chatting about, as well. I do quite a lot of work in the AIOps space, and that was, of course, named Will Cappelli, then at Gartner, back in 2015. And that kind of really put it into the instant management slot. And when we talk about that, we then kind of end up talking about higher levels of capability around things like self-healing and predictability. And we always have this conversation about predictability, about whether we should be able to predict, because if we can predict, then we should’ve known about it and fixed it already.

    And I think this is gonna lead us further into the AI conversation, because part of what we’re doing with observability is trying to get to our unknown unknowns. So, in traditional monitoring, we had a pretty good idea about what was going on in our monolith, but in our distributed environment, there are lots of things happening that we just haven’t got a clue about. And this is where observability, particularly, the AI part of observability really helps. I don’t particularly like the term “AI ops,” ’cause I think it really narrows us into the ops side of the house, which for me isn’t very inclusive of everybody in the technology and business team. I’ll stop there.

    Alan Shimel: Tomer?

    Tomer Levy: No, for me it’s, you know, terminology is secondary, and personally, I’m not actually such an expert in that. For me, you mentioned the contract between dev and ops and – and the contract is not just, you know, what measures are you going to use, but this should be a part of this, this should work. What you’re building is gonna work, it’s gonna perform, it’s gonna be, of course, traceable, and it’s gonna generate the right metrics, it’s gonna generate the laws. So, someone on the other side, or you, preferably, can understand how your software works. For me, observability is about accountability, it’s about independence, it’s about unleashing engineering team to be – just to run forward and do things and without kind of, “Okay, I’m gonna take this piece of software, I’m gonna give it to someone else, and I’m gonna wish him all the best and have a great night supporting this software.”

    No, no, no, you own it, you build it, you run it, and you generate everything you need to run. I can give an example: our engineering team, they cannot push anything to production without metrics and laws and _____ without _____ _____ _____ before they write the code. As they write, before they deploy, it has to be read, right? Then you push it and then you’re done. You know, it’s gonna be reported, you know how it’s gonna perform, you know, the business impact of it. It’s pretty amazing the impact of that.

    Alan Shimel: [Crosstalk] I’m sorry, go ahead, Brian.

    Brian Dawson: Well, no, I was just gonna say, you know, an opportunity to disagree, but I think it’s an important topic. I know we often, you know, talk about terminology and how we name things doesn’t matter. I’ve actually found, if you look at our industry and what we invest in it, oftentimes, where we go in and we play to own given terms in the market and we create word soup, there’s a real dollar cost behind that. As people, I’d say, sort of chase red herrings, right? “Well, AI ops is what I need to do to have successful development and stable systems. I’m gonna go figure out what that is and tackle it.” Tomer, I agree, it’s not the end all, be all. At the end of the day, it’s the core principle in practice, but I do think discussions like these that we’re having, “What is APM versus observability? Where does it fit?” enables us to establish a common language, so we can start to share and propagate these practices, you know, across different companies, industries, departments, and teams within our orgs. Anyway, sorry, Mitch, I stepped on you.

    Alan Shimel: No, Brian, that was excellent. I’m sorry, go ahead, Mitch.

    Mitchell Ashley: I think you were spot on, ’cause you were playing into what I was gonna say, and kind of speaking as an analyst. Analysts love to create categories and have people _____ _____ the defined categories, so, you know, there’s the person who created whatever category. And so, to early entrance of companies in those markets, I think there’s a bit of the conqueror writes history, right, as the dominant players tend to help establish what those terms are. But what I would say is I think the fluidity of these terms represents both the pace of innovation and just how much innovation is happening, as we get more and more cloud-native applications into production, as we do more and more cloud, multi-cloud, hybrid cloud, all of that, software, infrastructures, code, I think that’s what’s driving these questions of how do we manage all of this, how do we operate all of this, how do we use this information to inform the business about what’s happening. So we can know that we’re achieving our objectives for the customer, for revenue, for whatever it might be.

    But I think this sort of word soup is gonna be with us for a while, while we still kind of sort out getting more cloud-native types of applications into the cloud.

    Brian Dawson: By the way, I’m trying to stake a miners claim, what is that bad analogy, to DevNL. That’ll be the opposite side of, the counter to AIO.

    Mitchell Ashley: Oh, that means you registered the domain, is that what that – [Laughs]

    Brian Dawson: Yeah, I’m squatting, baby, I’m squatting [laughter] [crosstalk].

    Alan Shimel: Right, you know, and it’s all good [crosstalk]. Interesting stuff, folks. We’re way more than halfway past, you know, our time limit, here. And there was another, on the abstract, for those watching, you maybe read the abstract for this show and said, “Oh, I wanted to talk about scale, I wanted to hear about scale.” Let us talk a little bit about scale, but before we do, folks watching this, look, this is gonna be a series, we’re gonna do this I think it’s every-other-week or so. And, I mean, I want to explore the topics of how opensource really has been driving, the driving force behind observability. How some of the opensource foundations, you know, Brian’s with Linux Foundation, how they’ve fostered this growth and helped create this market and opportunity.

    And also, finally, you know, what it means for you out here, right? Observability can be your best friend or your worst enemy, in some cases, and, you know, we want to help you make sense of that, as well. But let’s talk about scale, now. So, guys, and gals, in my mind, you know, what’s the single-biggest inhibitor to successful observability scale, right? The datasets we’re talking about, just the sheer mass of bits and bytes that we need to wrap our heads and hands and programs around, in order to at least, you know, to have that data feed of which then we have to, you know, do analysis and hopefully come up with something actionable. I think that’s what’s held, you know, up to this point, it’s been a real issue. Tomer, I have to assume that it’s one of the reasons you said, “Hey, we need a solution, here.”

    Tomer Levy: Absolutely. I think scale has so many different factors. There’s obviously the scale of the amount of data, right? If you take a monolithic application, you know, line by line, and it’s creating, you generate some logs, and maybe pick up some metrics. Or you take a monolithic application and move it into 50 microservices, now they all need to report where they are, what do they do. It’s almost 50 times more data, so the amount of data is enormous. Now, we used to be fine with just logs. Then, you know, the app D came to the world and said, “Hey, let’s do some tracing.” Now, you multiply this traceability by 50, so you have _____ data, and you have traces, and you have metrics to report kind of meaningful events, and now you have to collect all this telemetry into one place, and the sheer volumes are just ridiculous.

    I see customers and they’re telling us, “Hey, I’m connecting, you know, 300 terabytes, a day, of telemetry data,” and you know it’s 99.9 percent useless. But there is, like the tree that makes noise, there is a bit of signal there that is important, and they really need it. How do you get to it? So there’s the scale of data, there’s the scale of the types of data, used to be only logs, and then it goes to different types of data that need to be merged together. I think there was a scale of human capacity, right, how can humans actually understand machine-generated data. _____ so much data, so much volatility, you know, so many different messages and types, just, they’re so smart, these engineers, but it’s really impossible to process trillions of messages.

    So, this is where you’re trying to solve that with, you know, AI, machine learning, and _____ _____ _____ technologies, and we do the same. We solve the scale problem, we solve the different types of data problem, and try to solve the intelligence with predictive technologies. And I think there is one that people don’t talk a lot about, which is the scale of teams and people within the organization. Now, you go to an organization and it’s not 1 company; it’s like 50 different organizations within the same company. They do app number one, app number two, they do, you know, PI, they do whatever. Certainly, every one of them need observability, and someone needs a whole enterprise observability.

    So, this is a huge _____ that we have actually _____ focused a lot beyond the normal, “How do we level an enterprise?” to really take all these pieces and _____ continue to work together, independently, unleashing productivity, and then the entire organization working collaboratively. So these are the kind of scale that I’m thinking about.

    Brian Dawson: And if I may quickly, Tomer, just, you know, when we talk about the scale of teams in organizations, right, now you look within that as we look at the scale at which we’re delivering cloud-native applications across multiple containers, across multiple sort of agile pizza-size teams, more and more sort of supporting the micro-architecture approach, right. We have multiple teams delivering at speed to their component or their area of an overall system, which oftentimes a customer, the end user experiencing it views it as one system, right? And that sort of underscores the need, as you said, Logz.io is providing the ability for those multiple teams, those multiple areas of an organization to have a shared view, so they can quickly observe, earn, and respond, to provide a unified customer experience, right? So just, as we scale across teams, it gets harder and harder to provide a holistic experience to those end users. Observability helps enable that.

    Mitch Ashley: Yeah, I think it’s also, another way to look at this is, who is working on this problem? And to be able to scale. And I think one of the healthy things about this part of our industry is there’s a number of opensource projects that are part of consortiums like the Linux Foundation and elsewhere. But I know, you know, that Logz.io is involved with Prometheus, as a number of companies are, and there’s a lot of ecosystem of other opensource projects that have split up kind of alongside Prometheus. There’s also, of course, Jaeger and OpenTelemetry, so, different folks are working on this problem in different ways. And what I like about – one of the main things I like about opensource is it brings people together, and that’s what Linux Foundation obviously does, and CNCF, and folks like that.

    This is a problem that no one person, no one company alone can solve. You could take a leadership role in solving it, you know, like Tomer and Logz.io _____, but that, to me, that’s a positive indicator of where we’re headed. And which one of those or multiple of those or win or lose, it’s not necessarily the questions; it’s, we will figure it out and it will come to fruition. And it’ll be able to be something that can be shared across the industry, at least in the opensource form.

    Brian Dawson: Yeah, and I’m sorry to jump back in, Mitch, but I love what you called out, there, in regards to opensource and Linux Foundation. And what we talk about a lot is, you know, we talked about this word soup, which is oftentimes not only analysts looking to define markets, but vendors. There’s revenue attached to defining market and owning terms, and I know while at the end of the day we’re all going into this with good intention, kind of the natural economics of business risks, someone trying to stake claim or ownership to a shared and important concept in their space. So, what I do think is important, whether it’s Prometheus, Linux Foundation, or other foundations, is that we ensure kind of some unbiased, an unbiased impartial playing field, right? For people to align around and establish sort of the concepts and frameworks, which we can all then go build on as end users, practitioners, vendors, et cetera. So I love the fact that I get to be in an organization that is playing a hand in building those impartial playing fields around spaces like observability.

    Tomer Levy: If I can say one more word, here, which I agree, solving such a huge problem as one company, it’s almost impossible. You know, there are some giants who are able to do it, but we’re true believers in opensource, we’re, you know, contributing to Jaeger, we’re working a lot with Prometheus, it’s part of our offering, we’re contributing to OpenTelemetry, to OpenSearch, and other projects. And this is what we – we literally embraced opensource to say, “Hey, this is the way the community’s going to solve it. We’re, you know, as a commercial organization going to contribute and make it better and more accessible.” And I believe forward, just the sheer power of the community will help bring it to becoming much more common technology that hopefully _____ will be able to adopt more easily.

    Alan Shimel: I hope so. Helen, we haven’t heard from you in a little bit. Thoughts on this?observa

    Helen Beal: _____ just making me remember a presentation I did _____ about a year ago now, about community looking at things like the [crosstalk] _____ _____ talk about industrial revolutions and where we are. So, we’re on the precipice of this golden age and moving into this very sustainable way of work, and I think there is a mind shift _____ _____ it’s like a global human mind shift, that we’re moving away from thinking about shareholder value and really understanding that we’re working together for the good of the planet. And maybe that’s a little bit too highfaluting, but I do think, you know, I’m doing work as a consultant _____ _____ _____ _____ Foundation. I think there’s, increasingly, this understanding that we need to cooperate in order to do the best work.

    Alan Shimel: I agree, I mean, I think that’s been one of the catalyst or gatekeepers of this if you wanna call it golden age of software development and digital adoption has been the coopetition, right? The coopetition aspect of industry joining hands with potential competitors, for the common good, of the whole world, and in the industry itself. And I think you’re dead on, Helen, we could look at value stream management, for instance, right, where we are measuring the flow, we’re examining and analyzing the flow. And based upon the flow of that data, you know, based upon the data that we get from this flow, we make decisions on how to do better. You know, contrast that or compare it to observability, right? Where does one leave off and the other pick up?

    Helen Beal: Yeah, I mean, they’re very much together. Actually, in the value stream management foundation _____ consortium is gonna be releasing _____ _____ partnership _____ _____ _____ _____ towards the end of the month. There is a whole article from I think it’s _____ Nelson, which is about observability being the BSM superpower. ‘Cause it is about _____ to look into our invisible pipeline, and this is – it feels like we’re in some kind of like _____, ’cause value stream management’s been around for a really long time, and, you know, it comes from the 1950s _____ _____. And yet, here we are again, but there’s a big difference, because we’re now talking about digital value streams. And they’ve always been particularly challenging, because we make them out of code, which is pretty much invisible, and we can put some _____ on top and things, and dashboards, but there’s a lot of stuff we can’t see in software.

    So, observability really helps us, not just _____ _____ when something’s broken, to fix it, but we can apply it to our whole value stream, look at our entire dev ops tool chain, and understand how _____ _____ and how well that’s flowing. I keep on talking about the use case, which is about customer experience, which, to me, there’s a duality in value stream management. It is about flow, but it’s also about value realization. So we wanna know how fast we’re getting that value to our customer, but we also want to know how they’re experiencing it. Is it good? Is it bad? Do they like it? Do they want more of it? And that’s another thing that observability can really help us with.

    _____ _____ as we talked about, there’s so much data out there that we have a limited _____ _____ ’cause _____ _____ it’s human, so we do need to use our machines against our machines or with our machines, so turning them in on themselves, so using our AI machines to understand our data, and observability machines. And, yeah, I’ve made it sound very simple, so, why isn’t everyone doing it? [Crosstalk]

    Mitchell Ashley: [Crosstalk] [Laughter]

    Alan Shimel: Guys, we’re coming up on the end of our time. You know, I feel like for every one topic we are broaching, it’s revealing two, three, four topics that we need to dive deeper in on our future episodes in this series. So we have a lot, a lot to cover in this observability area, but we’re gonna need to wrap up today. I wanted to give each of you a chance, you know, maybe your final thoughts on today’s episode, you know, on topic. And, you know, give someone, people watching, out here, a reason why they wanna come back and get more of this. Tomer, you went last, I believe, so I’m gonna ask you to go first. You went last in the beginning of the show; we’re gonna ask you to go first.

    Tomer Levy: Sure, yes, you’re so generous, thank you. So, maybe I’ll start with a quick – because I didn’t really say what Logz.io is doing, so I have to do it, otherwise, my boss is gonna be upset with me. 

    Alan Shimel: Okay. [Laughs]

    Tomer Levy: We’re a cloud observability company. We help companies monitor cloud. We offer metrics tracing and log management in one solution, includes _____ and includes everything for observability. The way we _____ differentiate _____ _____ opensource, actually, as I mentioned, our solutions are based on Grafana, on ELK, on Jaeger, so it’s a fully opensource-compatible solution, delivered from the cloud. One of the biggest advantages is, around AI machine learning, we’ve built some really cool technologies, crowdsourcing, machine learning, and bringing together. This is why we’re excited about observability. We have more than 1,000 paying customers, some of the largest companies in the world. And I’m excited for the rest of this series, so I think we covered a lot. I think scale is just a big problem, but there are other aspects of observability I’m excited to talk about. So thank you for having me, Alan, and it was nice to spend time [crosstalk].

    Alan Shimel: My pleasure, it’s my pleasure to have you on, Tomer. Thank you. It’s good to even see you. Helen, you’re the lady in the middle, it seems, so, why don’t you go next.

    Helen Beal: [Crosstalk] the rose between thorns or something. Yeah, so I’m gonna perform the sin of talking about word soup. I do think, my entire career, that the IT industry has its own jargon, but I think most industries do. If you went and looked in healthcare, I think you’d find a lot of TNAs and things, there, as well. But as Brian said, without language, we can’t communicate, so we do need to name things. But one of the things we didn’t really talk about today, which I’ve been thinking about a lot, lately, is TDD, BDD, HDD, IDD, ODD. So we’ve got all these DDs, so I started calling them XDD. So just to try and make sense of what I’ve just said, we’ve got task-driven development, behavior-driven development, hypothesis-driven development, impact-driven development emerging, and of course observability-driven development emerging, as well.

    And I don’t think they’re mutually exclusive, but I’d love to have a chat, in the future, with all of you in this type of forum or separate, about how to connect all these XDDs and make sense of them, to help that contract between development and operations that we were talking about, earlier. And thank you [crosstalk], as always.

    Alan Shimel: Thank you, and there’s always an invite here for you, Helen, you know that. Brian, do you have anything to say?

    Brian Dawson: Yeah,

    being facetious. [Laughter] [Crosstalk] it’s early, went completely over my head, hm. No, you know, I think an interesting topic to explore, as we kind of hit on here, is gonna be the common lineage between some of these things that become part of word soup: agile, continuous integration, continuous delivery, dev ops, observability. Which, you know, at the core, they really all are about control loops and feedback systems, right? In order to manage, state, and achieve a certain level of determinism for the systems that we’re delivering, I think it would be really interesting to talk about where those overlap and where we could uncover common best practices, as we sort of strive to implement these things. And then lastly, you know, a big of a plug is, look, I think as we embark, as we identify these new spaces, these new practices, and we embark on growing and adopting them, it is important that we find a place to meet on common ground, and if we – what did you call it, competitors?

    [Crosstalk] Coopetition, excuse me, it’s still early. Right? So, do take a chance to look into the opensource solutions that Tomer spoke about, do take a chance to engage with the community around those spaces, so you can not only learn about what these things are, but so you can contribute. And Alan, hopefully, we’ll do some of that here, on this channel, in incoming weeks.

    Alan Shimel: Absolutely, Brian, and the same as I said to Helen, always an open invite to come join us and contribute and help out on this. Mitchell, you wanna bring it home?

    Mitchell Ashley: Yeah, happy to, Alan. You know, it’s such an emerging and fast-moving field, what it makes me think of is, I think what we can do on this show, on this series, is help bring some clarity, as well as kind of tease things apart. I kind of go back to the goal, constraint-based management, you know, what’s the constraint? Where do we need to focus on to help move this forward? What’s the signal? _____ I’m thinking Gary Gruver, he’s always talking about the signal, right? Getting clarity about the things that we’re talking about. And so, I think with the brain power here, the experience, and I know the other guests that we’ll have on over time, I think this is something that we can really strive for is let’s, in addition to explore, let’s see if we can elevate a few areas maybe with some clarity. So it’s a good goal to shoot for.

    Alan Shimel: Absolutely. Well, panel, thank you so much for kicking off our series on observability. You guys have been great. Thanks so much to Logz.io for sponsoring and enabling this. This is needed in our community. We need to explore this. We need to shine a light, here, on maybe some of the dark corners around observability and how it fits into the whole process. So thank you all. Thank you, out here, for watching this. As I said, this will be a reoccurring series, every episode delving into another aspect of observability, so, stay tuned for it. You could always catch it on TechStrong TV, techstrong.tv, or at digitalanarchist.com, as well as on probably devopsy.kinsta.cloud and Container Journal, et cetera. For now, though, this is it.

    This is Alan Shimel. I hope you’ve enjoyed our first episode of observability at scale. We’ll see you on the next one, but we’re out. Bye-bye.

    [End of Audio]

  • SRE’s Guide to Pragmatic Incident Response

    SRE’s Guide to Pragmatic Incident Response

    In my past experience as an SRE, I learned some valuable lessons about how to respond to and learn from incidents. If you want the TL;DR, I’ll summarize them here:

    • Declare and run retros for the small incidents. It’s less stressful, and action items become much more actionable.
    • Decrease the time it takes to analyze an incident. You’ll remember more, and will learn more from the incident.
    • Alert on pain felt by people – not machines. The only reason we declare incidents at all is because of the people on the other side of those machines.

    Now, let’s dive into each of these lessons a little deeper, and explore how they can help you build a better system for pragmatic incident response.

    1. Focus on the Small Incidents First

    The bad habit of ignoring small issues often leads to bigger issues. You should run retrospectives for small incidents (slowdowns, minor bugs, etc.) because these often have the most actionable takeaways—instead of shooting the moon and creating “rearchitect async pipeline” as a Jira ticket that never happens. Focusing on low-stakes incidents and retrospectives are a great introduction to behavior change across your organization.

    Let’s look at an obvious example of how a focus on small incidents can have an outsized impact. Case in point—my apartment. I live in an old candy factory retrofitted into apartment units. We have an elevator (thank God), but some of the buttons don’t light up when you press them. The LED display doesn’t match up with the numbers on the floor buttons. Yes, the elevator goes up and down, but overall, you can tell that things are wrong with it.

    One day, I came home and noticed an “Out of Order” notice on the elevator door. Was I surprised? Not at all. Of course an elevator with mislabeled buttons and broken LEDs would stop working!

    This isn’t dissimilar from an important software lesson—ignoring small issues often leads to much bigger issues. What starts as an inconvenience can lead to a complete breakdown. This is why you should focus on the small incidents first. I hear a lot of companies say, “We need to fix incident response! Every time we have an incident, it’s just chaos!”

    They are talking about unexpected downtime during a high severity level incident and they want to improve it.

    I say that’s the wrong type of incident to use to fix your incident response system and process. Focus on the small incidents first. Running retros for small incidents can help you build strong incident response models, because they have the most actionable takeaways and they are the best way to change behavior through repetition and practice.

    If you have a high-stakes, 12-hour incident and you run a one-hour retrospective you’re not going to get the results you want. You need to start small. Run retros for bugs that were introduced; maybe a bad data migration that didn’t really impact anything but took up a couple of hours of your day.

    Heidi Waterhouse captured this idea really well in this piece on reliability. Every airplane you’ve ever flown on has many tiny problems, Waterhouse said, “… like a sticky luggage latch or a broken seat or a frayed seatbelt. None of these problems alone are cause to ground the plane. However, if enough small problems compound, the plane may no longer meet the requirements for passenger airworthiness and the airline will ground it. A plane with many malfunctioning call buttons may also be poorly maintained in other ways, like faulty checking for turbine blade microfractures or landing gear behavior.”

    I couldn’t agree more. Extrapolating to software: The small things are typically indicators of bigger issues and could cause catastrophes down the road.

    2. Track Mean Time to Retro (MTTR)

    It’s important to think about what you measure in your organization. You should be measuring how you’re improving, and the most important metric here is mean time to retro (MTTR). Everyone should be tracking MTTR. It’s a great statistic to improve incident response in your team because it helps you understand the delay between incidents and retrospectives.

    The easiest way to have a bad incident retro is to wait two weeks. It’s better to get into a room quickly and hash out what happened than wait a long time until you’ve got everything perfectly prepared.

    Tracking MTTR can help you hold prompt and consistent retrospectives after incidents. Set a timer and make an SLO or SLA for yourself that says, “This is how long we take for retros.”

    Retro time will vary depending on the severity of the incident itself. If it’s a SEV1, clear everyone’s schedules, because you need to have retro within 24 hours of the incident. For SEV3 incidents, you have much more leniency.

    I also like tracking the ratio of retros to declared incidents. This is a metric that should go up; you should see your ratio of retrospectives to incidents increasing. You can break down that number by severity, as well. If you have a low retro ratio for a SEV1 versus a SEV3 incident, that might be okay at first (remember, start small) but you want those metrics to eventually become equal.

    3. Alert on Degraded Experience with the Service, and Not Much Else

    The severity of incidents is directly linked to customer pain. We would not declare SEV1s if there weren’t a lot of people feeling a lot of pain.

    Alerting on computer vitals is an easy way to create alert fatigue and burnout. As your company starts to scale, you are going to use more CPU; you’re going to use more memory. Tying alerts to computer vitals is not a good sign.

    If I run, my heart will beat faster—it’s just doing its job. Paging people at 2:00 a.m. because disc capacity is at 80% even though you won’t run out of space until next month is a good way to lose great teammates. I have worked with people who left their previous companies strictly because they got paged too many times for stuff that didn’t matter.

    This is why you need to alert on a degraded experience with the service and not much else. A CPU burning hot at 90% is not necessarily a bad thing, but you need context to decide. Create SLOs that are tied to customer experience and alert on those. People experiencing problems with the service is the only thing you should alert on—for the most part.

    One of the best ways I’ve seen to think about this came from Soundcloud developers, who explained that you should alert on symptoms, not causes. My fast heartbeat is not necessarily a problem. But if my elevated heart rate leads to lightheadedness and I fall—that’s a problem. So, I need to be able to alert on something like that. Paging people at 2:00 a.m. because disc capacity is at 80% and you won’t run out until next month is not good. But paging people because you know that disc capacity problems cascade into other, systemic problems is. You can apply the same thought to other potential causes of an outage. Paging alerts that wake you up in the night should only be based on symptoms.

  • Why You Should Embrace Incidents and Ditch MTTR

    Why You Should Embrace Incidents and Ditch MTTR

    The cliché is that everyone in IT hates incidents, and the natural reaction when assembling incident response metrics is to look for numbers that you can lower over time. Fewer incidents and shorter incident response times must be better, we think. You might already be familiar with the common metrics associated with these goals, including mean time-to-resolution (MTTR) and total incident count.

    As it turns out, however, these metrics actually work against your company’s resilience goals. To understand why, let’s look at the industry that birthed most of our modern incident management practices and has learned the most about how to properly apply them: the airline industry.

    What the Airlines Can Teach Us

    From the 1950s to the 1990s, the airline industry built and refined best practices for incident management that we have since simplified and that have been widely adopted across the tech industry. What’s often termed “modern incident management” simply means the predictable and repeatable approach to handling unexpected disasters and the learnings-driven remediation steps that are prized when building a DevOps or SRE practice.

    One of the most important findings to come out of this research is the somewhat surprising fact that incidents weren’t being declared often enough. Instead, incident reports were created and the carefully assembled response and cataloging process was only followed after catastrophic events, which meant earlier opportunities to catch the underlying problem during a less severe incident were being missed.

    So why did an industry with such incredibly high stakes take so long to realize that more incidents were actually a good thing? You guessed it: a misguided desire to decrease the incident count. In chasing this goal of “lowering the number,” pilots and mechanics were often reluctant to file incident reports for anything less than the most critical situations, which meant the powerful, learnings-focused response and remediation process was only triggered in response to relatively rare and critical situations.

    This is a textbook example of Goodhart’s Law in action. To paraphrase, Charles Goodhart posited that any metric created will ultimately become the goal. In other words, if the incentives are aligned to reduce incidents, no matter how good your response and learning process is, it will only be executed in the most dire and unavoidable circumstances. After discovering this, the industry rapidly moved their focus towards expanding the use of the incident process by working to expand the spectrum of situations that could be classified as incidents with the goal of triggering the formal incident response process more often, distributing learnings for more incidents of lower relative severity and, yes, ultimately resetting the goal to increase the number of incidents.

    This approach effectively turned Goodhart’s Law to the airlines’ advantage—any effort to game the metric(s) meant more learning, not less. Filing incidents became directly and heavily incentivized and these metrics were never used as a justification for punitive action. This resulted in the safest decade of commercial aviation on record, with over 12 billion passengers traveling and no fatal accidents.

    What IT Can Learn About Successful Incident Response

    As technology companies, there is much for us to learn from this exercise in achieving resilience versus chasing “lower numbers.” The primary learning is this: increasing your incident count by incentivizing the use of your incident management process for more non-critical incidents—likely your SEV2s and below—and focusing your metrics and incentives on that goal, is likely the best way to reduce your overall count of catastrophic failures.

    For most companies, this means putting MTTR on the back burner and instead focusing on making the incident process itself more accessible throughout your company and across your organizations. It means leaders should talk about impactful and recent postmortems publicly and that postmortem distribution should be a priority; it should also be something that’s measured. Most importantly, it means opening up the incident management process more widely. Ideally, everyone at your company should have access to systems that allow them to file incidents, read incidents in progress and review postmortems from previous incidents.

    I like to reference the “big red button” philosophy of factory floors, where the decision-making power to declare an incident is in the hands of every employee. An unsafe situation shouldn’t be up for discussion, debate or approval before being acted on, even if the situation is later determined to be less severe than originally thought. The context of why that incident was filed—why that big red button was pressed—may prevent larger, more catastrophic failures in the future.

    So if you’re just getting started building out an incident management practice at your company, or you’ve been chasing MTTR metrics and focusing on pushing your incident count down as a primary goal, consider taking these learnings to heart and creating a positive incident culture with positive metrics meant to encourage and reward incident responders and reporters. Your company’s future depends on it.

  • Iterative Indicators: Measuring DevOps ROI

    Iterative Indicators: Measuring DevOps ROI

    It’s well-established that application of ROI measurements to IT investment remains an imperfect science, and the same goes for ongoing adoption of DevOps methodologies.

    The fuzzy math of vendor-driven ROI calculators aside, even the most respected industry watchers have long struggled to create concrete parameters for assessment of technology spending. This, in large part, has been related to the fact that the requirement for continued investment has outweighed the value of short-term metrics.

    At the same time, it’s hard to put a price on the influence that paradigms including mobility, virtualization and the cloud are having on today’s business world. The scope of the so-called Applications Economy is only truly beginning to be realized.

    For in-depth discussion of DevOps ROI, register today for the upcoming webcast “Maturity Metrics – Analyzing the 2016 State of DevOps Report” with noted industry expert Gene Kim.

    With DevOps, the challenge of ROI measurement evokes similar characteristics as with these other bellwether movements. The affect that leveraging DevOps to become more agile and respond adeptly to changing customer expectations will have, long-term, ultimately will be realized as much in organizational viability as in any immediate cost-savings or other factors.

    That said, the recently published 2016 State of DevOps Report, assembled by the researchers at DevOps Research and Assessment (DORA), goes further down the path toward creating meaningful ROI metrics than any other such previous effort.

    For starters, the 2016 report builds on previous year’s conclusions that so-called “high-performing organizations”—those already deeply engaged in DevOps practices—are “decisively outperforming their lower-performing peers in terms of throughput,” and this gap continues to widen.

    Moreover, DORA contends that high performers deploy applications code 200 times more frequently than slow performers and achieve 2,555 times faster lead times. Perhaps even more importantly, in particular as it relates to the ability to improve applications performance, the report estimates that leading DevOps practitioners lay claim to 24 times faster recovery times and three times lower change failure rates.

    The State of DevOps Survey, completed by roughly 4,600 technology practitioners, also found that high-performing teams spend far less time on so-called “unplanned work and rework”—most often required to address existing problems—allowing them to spend nearly 50 percent more of their time on new work. The latter brand of effort is typically aimed at adding or improving feature functionality—or, in simple terms, innovation.

    As increased software velocity and reduction of MTTR represent the most critical differentiators in today’s environment, where an end user may wait only seconds for an app to load before abandoning your brand altogether, these conclusions obviously carry impressive weight.

    Finally, based on a framework established by research analysts at IDC which suggests that hourly application downtime costs can range from $1.25 to $2.5 billion for a Fortune 1000 firm, and that the average cost of a critical application failure is $500,000 to $1 million per hour, the State of DevOps Report allows for the conclusion that high-performing organizations save an average of more than $91 million per year.

    Much of this advantage is found, the researchers note, in the form of lower applications change failure rates, or those updates to software code that result in subsequent performance issues or outages. While high-performing DevOps practitioners experience an average change failure rate of 7.5 percent, medium-performing organizations see that figure rise dramatically, to a whopping 38 percent.

    If the undeniable adage that “time is money” applies in today’s Applications Economy as much—if not more than ever—than these ROI calculations would appear to infer substantial meaning.

    Later this month, Gene Kim, one of DORA’s founders and a key contributor to the State of DevOps Report, will host a webcast with CA Technologies expert Aruna Ravichandran to discuss DevOps ROI and many other related topics. Register for that event today.

  • State of DevOps Report: Reaping Results

    State of DevOps Report: Reaping Results

    The newly released 2016 State of DevOps Report concludes that DevOps is “no longer a mere fad or buzzword,” but rather an established set of practices and cultural patterns. Yet, a closer look at this year’s findings reveals progress is far more substantial than any matters of perception.

    The report was conducted and analyzed by the experts of DevOps Research and Assessment (DORA) and sponsored by CA Technologies. Among its findings is proof that high-performing organizations that have embraced agile and DevOps methodologies deeply are outperforming massively those that have not. And the gap is widening.

    The State of DevOps Report also shows leading DevOps practitioners are appreciating benefits that span nearly every area of their business. If I know my colleague Gene Kim, he will assert this point exuberantly on our upcoming State of DevOps Report Webcast.

    It’s noteworthy that high performers are surpassing incredible milestones related to core elements of the applications life cycle. Examples include deploying code 200 times more frequently than low performers, driving 2,555 times faster lead times, 24 times faster recovery times and producing three times lower change failure rates. This is evidence that DevOps is having the desired outcome on applications delivery, software quality and organizational velocity. It also shows organizations truly committed to wholesale transformation of culture and process are actively succeeding.

    At the same time, the State of DevOps Report shows employees working at organizations enjoying this success are more satisfied with their jobs and more closely engaged with their companies. Chalk this up to the halo effect of operating in a fundamentally more sensible, innovative fashion. Cultural change is undoubtedly the greatest hurdle to DevOps advancement. Here’s proof that if you can navigate the process, your workers will be happier and more productive.

    Using Employee Net Promoter Score (eNPS) as a barometer, the report finds that employees in high-performing organizations were 2.2 times more likely to recommend their organization as a great place to work. They also were 1.8 times more likely to recommend their team as a great working environment. Previous studies have found that such an air of positivity can be directly correlated with improved business outcomes, researchers noted.

    Shifting the manner in which you build applications to better adapt to changing customer expectations is a necessity. That’s what began driving this movement years ago. That said, proof it also makes it easier to keep valued software engineering and IT operations employees should not be overlooked.

    In addition to positive conclusions on the impact of continuous delivery and improvement of test data management, the report offers some important metrics related to return on investment. This is nothing short of landmark, as for decades we have struggled to make a hard case for IT investment beyond implied competitive advantage. It actually was impressive that last year’s report highlighted such a “predictive relationship between IT performance and organizational performance.”

    One such new measurement of note is that high-performing teams occupy the least amount of time responding to unplanned work and rework—efforts widely recognized to be results of flawed processes. On a related note, DevOps leaders spend 49 percent of their time on new work‚ surely, in many cases, the next “must-have” feature which impacts competitive standing and, ultimately, the bottom line.

    This report is fantastic. It reaffirms powerfully that so many of the promises made about DevOps over the last few years are neither hype, nor overstated. The gap between the leaders and laggards is growing. Industry landscapes and business models are being redefined.

    This is critical transformational work that every organization must adopt to survive.

    Are you on board? Download the full State of DevOps Report here.