series database unit64 millisecond timestamp, float64 value Instrumentation & exporters Not for event logging Dashboarding via Grafana Richard Hartmann & Frederic Branczyk @TwitchiH & @fredbrancz Intro dynamic, built-in service discovery No hierarchical model, n-dimensional label set PromQL: for processing, graphing, alerting, and export Simple operation Highly efficient Richard Hartmann & Frederic Operations & observability Outro Grafana Supports dozens of data sources Modern UI Allows for complex data manipulation and visualization Native Prometheus support New feature: Interactive exploration

dynamic, built-in service discovery No hierarchical model, n-dimensional label set PromQL: for processing, graphing, alerting, and export Simple operation Highly efficient Richard Hartmann & Frederic supports more than just metrics Every single data point in a time series can point to one single event Especially useful if you emit one trace id per histogram bucket Some integrations already support

一个故障，下面我们来聊一下这个收敛逻辑。 告警收敛逻辑 一般收敛逻辑是三级收敛，event -> alert -> incident。举个例子，最原始的告警事件，比如 host1 在 timestamp1 产生了一条 cpu_usage_idle 的告警，我们称为一个 event。如果没有恢复，一段时间之 后，比如 timestamp1 + 60min，一般会再发出一个告警，还是 60min，一般会再发出一个告警，还是 host1，还是 cpu_usage_idle 这个指 标。很明显，这两个告警事件是有关联关系的，指代的是一个问题，只是时间戳不同，这样的两个 event，就可以收敛为一个 alert。 从实现上来说，告警策略（也称告警规则）+ 指标标签集的哈希值，可以作为 alert 的唯一标识。比如 刚才的例子，告警策略的 ID 假设为 32，标签集是：[“name=cpu_usage_idle” ["__name__=cpu_usage_idle", "host=host1"]) 从 event 到 alert 的这个收敛逻辑，我们叫做一级收敛。只有这个收敛逻辑还不够，告警信息还是比较 散，不能基于这些散乱的告警分别做协同，把多个 alert 收敛成一个 incident（故障），基于 incident 做协同才比较方便。但是，event 到 alert 是有一个固定的收敛逻辑的，可以通过程序自动收敛，而

supports more than just metrics Every single data point in a time series can point to one single event Especially useful if you emit one trace id per histogram bucket, i.e. exemplars Some integrations