Show Me the Receipts: A Forensic Hunt for Observability
summary
Shows a repeatable forensic audit that traces resolved incidents back to the exact telemetry that enabled resolution, yielding 30% log reduction for one security team and avoiding seven‑figure SIM overages. Uses OpenTelemetry and Vector to centralize collection and apply transforms like logs→metrics transformation, sampling and throttling. Finds receipts in support tickets, postmortems and dashboard links, maps incidents to specific log sources, and automates rules in the pipeline to stop ingesting unused telemetry.
AI-written summary · about
chapters (11)
- 0:00Forensic observability hunt intro
- 1:44Crime scene analogy
- 3:10Cost of observability data
- 5:40Useful observability data
- 7:31Support tickets receipts
- 9:16OpenTelemetry and Vector logs
- 12:24Vector pipeline demo
- 15:34Key takeaways
- 16:36Auditing observability data
- 17:17Hunting receipts in org
- 18:07Closing remarks
related talks
02h 41mThe Science of Signals: Mastering Telemetry for Observability
22mShift Into an Observability Mindset with OpenTelemetry
20mSeeing Is Believing: OpenTelemetry and OpenSearch in Next-Gen Observability
52mHow to effectively spy on your systems
11mObservability 2.0 - Much more than just logs,metrics and traces
01mObservability
28mCorrelating Signals in Opentelemetry: Benefits, Stories, and the Road Ahead
36mObservability For You and Me with OpenTelemetry