Cases8 cases

1 to 5 of 8

1. IL-0451 Setting indexes INVISIBLE on Aurora MySQL 3.10 spiked CPU and ReadIOPS on all three readers but not on the writer

   Daangn2026

   Symptoms

   Daangn's DB team set unused indexes of one table to INVISIBLE, one at a time, on an Aurora MySQL 3.10.x cluster with one writer and three readers.

   Cache hit ratio drop

   Trigger

   The DB team ran ALTER TABLE store_reviews ALTER INDEX ... INVISIBLE for unused indexes, one at a time, as the first step before dropping them.

   Root cause

   Software defect

   Component

   DatabaseSchema migration

   Contributing factor

   Unverified assumption

   Detection

   CloudWatch showed reader CPU and ReadIOPS spikes that lined up one to one with the three ALTER INDEX INVISIBLE statements.

   Action items

   • Upgrade to the next Aurora MySQL LTS release that contains the fix
   • Until then, run index DDL in low-traffic hours
   • Combine changes to several indexes into one ALTER statement so the reader buffer pools are invalidated once instead of N times

   Lessons

   On Aurora MySQL from 3.08.0 up to before 3.14, making an index INVISIBLE is not free: the writer sees nothing, but every reader loses its cached pages of the whole table, and the larger and busier the table, the bigger the CPU and ReadIOPS spike while the cache warms again. Until the fixed version is in use, index DDL should be treated as an operation that empties the reader buffer pools. When looking for unused indexes, the usage statistics must be read on every node, because an index unused on the writer may be used heavily on one reader. Querying information_schema.INNODB_BUFFER_PAGE scans the whole buffer pool and takes seconds and adds load on large instances, so it is not a query to run routinely in production.

   View case
2. IL-0570 Dropping an unused MySQL table stalled queries on its busy parent table and crowdworks.jp was hard to reach for a minute

   CrowdWorks2026

   Symptoms

   Right after a deploy ran a migration with drop_table to remove a table that was no longer used, database queries started to pile up and crowdworks.jp was hard to reach for about a minute. The migration finally failed on a timeout and the service recovered on its own.

   Lock contention or deadlockIntermittent connection failures

   Trigger

   An engineer's deploy ran a migration that used drop_table to delete a table no longer in use.

   Root cause

   Faulty deployment

   Component

   DatabaseSchema migration

   Contributing factor

   –

   Action items

   • In migrations that may take an exclusive MDL on a high-traffic table, through DDL on the table, adding or removing a foreign key to it, or creating or dropping a table with such a foreign key, run SET SESSION lock_wait_timeout = 3 first
   • Write these migrations with def up and def down instead of def change, setting the timeout before the DDL in both
   • Put only one such DDL in each migration
   • Release migrations that contain such DDL on their own
   • Run them during low-traffic hours
   • Document the rules in db/migrate/README.md
   • Point AGENTS.md at that README so Copilot and other AI agents review migrations against it
   • Add the check to the automatic comment posted on pull requests that change db/migrate

   View case
3. IL-0369 Railway's backend API went down when a column migration waited on locks and replicas could not get database connections

   Railway2025

   Symptoms

   At 15:18 UTC on 9 December 2025, Railway's backend replicas became unhealthy and stopped serving traffic. Dashboard access, CLI operations, logins, the API and the processing of GitHub-based deployments were disrupted, while running deployments stayed online.

   Probe failuresLock contention or deadlockDatabase overloadService outage

   Trigger

   Engineers merged a database schema change with a data migration at 15:03 UTC, and the migration began applying at 15:17 UTC. It added a nullable column to a heavily used table of about 1 billion rows.

   Root cause

   Faulty deployment

   Component

   DatabaseDatabase proxy and connection poolerSchema migrationLiveness and readiness probes

   Contributing factor

   Health check tied to a dependency

   Action items

   • Increase database connections and reconfigure PgBouncer to work within those limits
   • Fix the long-running query so it no longer causes row lock issues

   View case
4. IL-0554 A database migration used up Sentry US's Postgres connections, and the site and event ingestion were down for 22 minutes

   Sentry2024

   Symptoms

   From 3:42 PM to 4:04 PM PT on 10 October 2024, the Sentry US site and event ingestion were unavailable, and the status page reported an issue with the Postgres database that made the site unavailable. The dashboard, the API and every US ingestion type, including errors, transactions, attachments, profiles, replays, spans, cron monitoring and custom metrics, were affected.

   Service outageDatabase overload

   Trigger

   A database migration ran certain database operations through the RunSQL command without lock and statement timeouts.

   Root cause

   Faulty deployment

   Component

   DatabaseSchema migration

   Contributing factor

   No configuration testsNo runbook

   Remediation

   • Issued a fix, after which the dashboard and ingestion recovered

   Action items

   • Replace RunSQL commands with more robust solutions in the migration framework
   • Update the database framework to the latest version, which handles some operations RunSQL was used for
   • Write runbooks for recovering from lock or timeout issues during migrations
   • Improve alerting and observability so the team reacts sooner

   View case
5. IL-0523 TANF-app production deployments were blocked for two months when a search-index migration ran out of database disk space

   U.S. Department of Health and Human Services2023

   Symptoms

   On 20 September 2023 the sprint 82 production deployment of TANF-app failed with a disk space error while it ran a large search-index migration, search_indexes 0017, against the production PostgreSQL database on cloud.gov. Production could not be deployed again until 9 November.

   Deploys failingNode disk full

   Trigger

   The sprint 82 deployment on 20 September 2023 recreated the deleted search_indexes migration 0016 and ran the large migration search_indexes 0017 against the production database.

   Root cause

   Faulty deployment

   Component

   DatabaseSchema migration

   Contributing factor

   Overlapping failuresGap in automated testsUnrepresentative stagingNo runbook

   Detection

   The sprint 82 production deployment failed with a disk space error, and the large migration search_indexes 0017 was identified as the cause.

   Remediation

   • Increased the production database instance size and re-ran the migrations
   • Created a backup of the production database
   • Truncated all of the search_indexes tables
   • Redeployed the sprint 82 release
   • Fixed the bug that stored empty fields as blank strings

   Action items

   • Write troubleshooting steps for database problems into the technical documentation
   • Write wiki pages and operations playbooks that outline common problems and responses
   • Add a database section and the cf revisions command to the failed-deployment troubleshooting document
   • Keep a GitHub repository of changes made directly to production
   • Save terminal output from production debugging sessions
   • Create Django migration best practices to enforce in code reviews
   • Do not edit migrations that have been merged to develop; write a new migration instead
   • Rename auto-generated migrations to more descriptive names
   • Use one auto-generated migration per model change and regenerate when a pull request makes successive changes
   • Organise a discussion on database seeding and backups for testing

   Lessons

   The work was unplanned and pulled in many developers from a small team, so the team wants documentation and playbooks that let fewer people step away from current work. Large datasets and unexpected edge cases such as rows without space-fill had not been tested, and a copy of the production database with PII scrubbed would allow tests against real-world data. Deploying in-progress code to other environments and changing migrations afterwards had caused conflicts there.

   View case

By root cause2