Correlation is the real work, not the dashboard
Grouping thousands of alerts into a handful of incidents does more for mean time to resolution than any single clever detector. Why event correlation keeps being underrated.
An independent notebook on the systems, the research and the habits behind running infrastructure with the help of modern models — written for engineers, not for the hype cycle.
For a decade, monitoring meant thresholds and pagers. The more interesting question now is whether a system can recognise the shape of trouble before a threshold is ever crossed — and what it should, and should not, be allowed to do about it on its own.
Grouping thousands of alerts into a handful of incidents does more for mean time to resolution than any single clever detector. Why event correlation keeps being underrated.
Hard failures are easy to catch. The expensive outages announce themselves gently — a latency curve bending upward for forty minutes. What it takes to notice in time.
Teams that score change risk from history — similar changes, the same configuration items, the same owners — catch the quiet ones that manual review waves through.
A model that cites the exact procedure it used — and says “this is not written down” instead of inventing — changes what first-line support can safely close on its own.
Idle instances and oversized reservations are most of the waste. Using models to surface and explain them — then letting humans decide — is where the savings actually land.
Running open-weight models on your own hardware is no longer exotic. The harder, more valuable work is deciding — in code — what is allowed to leave the network at all.
One carefully chosen piece on AI in IT operations, every other week. No vendor pitches, no breathless predictions — just what is actually working and what is not.