Incident Library
  • Root cause
  • Component
  • Symptom
  • Contributing factor
  • Case

Cases3 cases

1 to 3 of 3

  1. Symptoms

    From the evening of 27 September 2026 (UTC), InfluxDB Cloud customers in Azure West Europe saw slow queries and query timeouts, and a query queue depth alert fired at 22:58 UTC. Writes were accepted the whole time, but new data on some partitions could not be queried right away.

    Root cause
    Component
    Contributing factor
    Detection

    A query queue depth alert fired at 22:58 UTC on 27 September and an incident was opened.

    Remediation
    • Doubled query-layer capacity
    • Restarted stuck storage pods one at a time
    • Raised the readiness probe timeout and rolled it out fleet-wide
    • Doubled recovery concurrency after a restart
    • Raised the cleanup timeout to 24 hours, which stopped the forced restarts
    • Raised each storage pod's resource request so each host held fewer pods, doubling page cache memory and disk throughput per pod
    Action items
    • Add warning alerts for page-fault rate, cache coverage, disk reads on storage volumes and query abandonment
    • List major page faults in the runbooks as a leading indicator of storage performance degradation, with the relief valves that can be tuned
    • Keep tracking down the storage-engine reference leak
    • Move the disk check out of the health path
    Lessons

    Because the storage process uses little memory and the page cache takes what is left, a page cache too small for the data being queried does not show up as memory pressure on the usual memory metrics. InfluxData now treats major page faults as a leading indicator of storage performance degradation and alerts on cache pressure before customers see it.

  2. Symptoms

    On 26 September 2018 at 10:51 JST the whole Mackerel monitoring service stopped working properly and its alive monitoring stopped. The application servers could not connect to Redis, which stores Mackerel's monitoring data, and could not return correct responses.

    Trigger

    Redis memory use had been growing, so operators set up replication in order to scale Redis up. Building the replication took a long time and Redis stopped answering for a while, and keepalived treated this as a node failure and started a failover nobody intended.

    Root cause
    Component
    Contributing factor
    Remediation
    • Switched back to the correct Redis and briefly saw the application return
    • Restarted the application servers one after another, which did not improve the symptoms
    • Detected the organizations posting inappropriate metrics and blocked their requests
    • Adjusted the timeout interval of the application servers
    • Temporarily added capacity to Diamond, the TSDB
    • Increased the number of Kinesis shards and Redis Cluster shards
    • Scaled out the API application servers
    • Put Mackerel in maintenance mode, checked it internally and let outside requests back gradually
    Action items
    • Raise the number of keepalived health checks for Redis so a brief load increase does not trigger a failover
    • Scale Redis up
    • Add more application servers
    • Change the application to store only the monitoring data it needs in Redis, reducing Redis memory use
    • Build a way to detect inappropriate API requests quickly and show them on a dashboard
    • Build a function to block organizations making inappropriate requests quickly
    • Keep improving the accuracy of detecting inappropriate requests and consider adding features such as an API limit
    • Strengthen monitoring of the application servers' internal processing so problems are handled before they become outages
    Lessons

    Hatena did not find why recovery took so long, but expects that keeping failover from reacting to short load spikes and giving the application more performance headroom would prevent an outage this long. It also aims to keep problems contained to a small part of the service when a failure does happen.

  3. Symptoms

    On Saturday, September 27, 2014 at 6:50 p.m. UTC, Mailgun saw that all its database replicas and the internal traffic between its environments in all regions were broken and reporting timeouts. Once Rackspace began rebooting cloud instances in its Chicago data center (ORD), Mailgun customers had intermittent connection failures.

    Trigger

    Rackspace, Mailgun's parent company and hosting provider, rebooted cloud instances in its Chicago data center (ORD), and the cloud maintenance triggered an error condition on Mailgun's F5 load balancers.

    Root cause
    Component
    Contributing factor
    –
    Detection

    Mailgun noticed at 6:50 p.m. UTC on September 27 that all database replicas and the internal traffic between its environments were broken and reporting timeouts.

    Remediation
    • The Rackspace networking team cleared the cached path MTU on Mailgun's F5s and on some Rackspace dedicated customers' F5s
    • Set up a new virtual IP for Mailgun services
    • Changed Mailgun's DNS settings, which forced the remote F5s to clear their caches
    Action items
    • Finish the root cause analysis of the F5 path MTU problem with Rackspace
    • Make sure maintenance of Mailgun's cloud infrastructure has no impact on Mailgun customers
Check your cluster for this

These 3 cases involve Database replication and In-memory cache. kubegap audits a Kubernetes cluster for gaps like these, read-only, from Claude Code or Codex; its checks cite public reports like the ones in this library.

By root cause3