Back to tags
#monitoring
the dashboards you check before you check anything else.
3 blog posts · 1 TIL.
Posts about what to watch and what it costs to watch it. The Prometheus and Grafana guide is the stack end to end, with the dashboards and alerts that earn their place and the ones that do not. The JA4 incident runs the other direction: a TLS fingerprinting rule that took down thirty percent of production, reconstructed from the timeline. The short JA4 note is the follow-up on metrics cardinality, and why a fingerprint that splits into parts is far cheaper to label than one that does not.
Blog posts
Threshold alerts page you for causes that may not matter. Multi-window burn-rate alerts page you once, for the symptom, when the error budget is genuinely…
Deployed a TLS fingerprinting rule that seemed reasonable. Blocked every Chrome 119 user on Windows. The incident report was not fun to write.
A practical guide to setting up Prometheus and Grafana for production monitoring. No theory, just battle-tested configurations that work.
Today I learned
Rotating ciphers exploded our TLS client metrics to 50k unique fingerprints. JA4's split format dropped that to under 200 without losing detection.