Incident Library
Applied filters ComponentContainer runtimeFactorExcessive blast radiusOrganisationMUSINSAClear allEvery case under the filters, with no sentence; newest first.
Suggested filters Search, and the values found in your words appear here.

Graph

  • Root cause
  • Component
  • Symptom
  • Contributing factor
  • Case

Cases1 case

1 to 1 of 1

  1. Symptoms

    The on-call engineer for a high-traffic service was alerted that requests were failing in large batches every 30 seconds.

    Trigger

    DEBUG level logging was on in production when traffic surged, raising log volume to about 100 times normal while the service logged synchronously.

    Root cause
    Component
    Contributing factor
    Detection

    The on-call engineer was alerted that requests were failing in large batches every 30 seconds.

    Action items
    • Replace synchronous logging with TraceAwareAsyncAppender, which captures trace_id and span_id on the calling thread and drops logs instead of blocking when the queue is full (neverBlock=true)
    • Keep the amount of log output at a sustainable level, since an asynchronous queue still fills under sustained overload
    Lessons

    Removing AsyncAppender to keep trace IDs also removed the protection that kept request threads away from stdout back-pressure. A company-wide standard applies the same side effect to dozens of services, so check what a standard rests on and what working behaviour it takes away. ThreadLocal context does not cross into an asynchronous worker, but capturing it on the calling thread before handing the event off keeps both the IDs and the asynchronous output. Under extreme load, dropping log lines is preferable to stopping request handling.

Check your cluster for this

This case involves Container runtime and Application database. kubegap audits a Kubernetes cluster for gaps like these, read-only, from Claude Code or Codex; its checks cite public reports like the ones in this library.

By root cause1