Operations | Monitoring | ITSM | DevOps | Cloud

In today's digital landscape, security and observability teams face an unprecedented challenge: managing massive volumes of data while maintaining both performance and cost-effectiveness. As organizations generate more data than ever before, the traditional approach of storing everything in high-performance, expensive systems is becoming unsustainable. How will your team evolve how it manages and uses telemetry data across the enterprise?

We recently worked on an RFP for a customer whose primary driver was compliance with the new Digital Operational Resilience Act (DORA) regulations. The project aimed to make financial services more reliable and secure, protecting both consumers and the technology provider. Helping with this RFP was a rewarding learning experience due to this effort’s high priority and the key challenges faced by this organization.

AI is now a go-to tool for everything from writing to coding. Modern LLMs are so powerful that, with the right prompt and a few adjustments, they can handle tasks almost effortlessly. At Coroot, we’ve been experimenting with AI for observability. Our goal is to make it useful in the final stage of troubleshooting—when we’ve already identified which service is causing issues, like Postgres, but finding the exact root cause is still tricky due to the many possible scenarios.

In the realm of modern software development practices, observability is no longer an optional add-on. It is a mission-critical capability. Like how control theory revolutionized industrial systems, and quality assurance redefined manufacturing processes, observability transforms the software systems and their development processes in many ways inspired by the brick-and-mortar industries. This post explores the best practices in modern observability to help you leverage its full potential.

Back in Alerts Are Fundamentally Messy, I made the point that the events we monitor are often fuzzy and uncertain. To make a distinction between what is valid or invalid as an event, context is needed, and since context doesn’t tend to exist within a metric, humans go around and validate alerts to add it. As such, humans are part of the alerting loop, and alerts can be framed as devices used to redirect our attention. In this post, I want to drive this concept a bit further.

There are a limited number of investments that a team can make in any given year and it can be daunting to choose the “right” ones. In R&D, there is always more to do. There is always more to research, design, build, fix, maintain, and improve. Spread across multiple domains, the possibilities multiply: we’re spoiled for choice—and, while inspiring, the breadth of possible investment areas can be overwhelming.

I’ve spent over 25 years in tech product marketing and customer support, working with pioneering companies like Dell/EMC, Apple, Keeper Security, and now, SolarWinds. In my current role, I’ve had the privilege of helping organizations of all sizes achieve comprehensive observability in their IT environments. I’ve also witnessed firsthand the challenges that can arise on this journey.

At Coroot, we started using eBPF to give users insights into their system performance without needing them to change code or redeploy services. This approach not only makes setup easier but also ensures full visibility, even for third-party and legacy services. To truly achieve this, though, the tool needs to support a wide range of application protocols. Coroot has long supported popular ones like HTTP, gRPC, Postgres, MySQL, Redis, Memcached, MongoDB, Kafka, and Cassandra.