Opens in a new tab
Explainer

How old is the answer on your dashboard?

In brief

A dashboard can refresh long after its measurements stop. Follow the event through collection, evaluation and delivery to find where the view went stale.

4 min read

Is this the right starting point?
Before you read
No prior monitoring-system knowledge; the observation path and timing terms are explained.
What you will take away
Distinguish a fresh display from fresh evidence and locate delay between event, collection, evaluation and delivery.
Sources
An illustrated engineer holds a printout marked 09:00 and zero beside a clock reading 09:10. Paper trails from the printer.
On this page3 sections

Imagine it's 09:10 and a customer says checkout is failing. You refresh the dashboard. Zero errors, it says. Then you notice the last observation arrived at 09:00. The evaluator stopped at 09:01, and the page has been serving up the same answer ever since.

Keep that zero beside the time it describes. A monitoring system needs to carry a new observation from the service to the person who can use it. When the observation goes missing, the useful answer is that the current state is unknown, with enough detail to find out where the trail stopped.

Follow the seven minutes

A checkout finishes or fails. The service emits a record, a collector receives it, and storage makes it available for evaluation. The evaluator checks an interval of observations and can send a result to a responder. The page you refresh may be reading a value prepared somewhere along that path.

Suppose a 09:00 event reaches storage at 09:07 and is evaluated immediately. Most of that wait happened before storage. If the same event reached storage promptly and evaluation finished at 09:07, you'd look at a different part of the system. The two dashboards could both update at 09:07. It is the earlier timestamps that help you find the delay.

Four places to check the age of an observation
Four places to check the age of an observation. An old source event and a fresh event that sat unevaluated can produce the same display delay. These four timestamps help tell them apart.
An old source event and a fresh event that sat unevaluated can produce the same display delay. These four timestamps help tell them apart.
Read diagram description

An old source event and a fresh event that sat unevaluated can produce the same display delay. These four timestamps help tell them apart. The diagram follows the service event to collection and storage, then evaluation, then delivery and acknowledgment. Check when the event happened, when it was recorded, what interval the evaluator used and when someone who could help learned the result.

Give each reading a freshness limit based on the decision it serves. The last hourly capacity report can be useful for planning. Checkout may need evidence sooner if waiting leaves little time to help. Show the age of the source observation and the period it represents, so the person looking at it can tell whether it still serves that decision.

The zero belongs to 09:00

A period with observations and no errors can honestly show zero observed errors. A period with no observations is a different state. Carrying the last zero across the gap makes the drawing easier to read at the cost of making its meaning harder to trust.

For an important signal, choose who will investigate when its data goes stale and how they'll get a current view. A synthetic checkout, an approved test that exercises the customer path, might supply evidence while the main feed is being repaired. Make sure the fallback can still work when the failed part of the normal path is unavailable.

To rehearse the delivery path, send a known test event through collection, evaluation and routing in a safe exercise. Check where the alert lands and who can acknowledge it. A rule test can prove the expression gives the expected answer on sample data. It can't prove that the real notification arrives. Prometheus's alerting guidance makes the same distinction by recommending a test that follows delivery through multiple monitoring components.

When new events arrive but the answer stays put

If storage already contains the 09:09 checkout events but the last completed evaluation covers 09:00, begin with the evaluator. If storage has nothing later than 09:00, look earlier in the path. Neither observation identifies the exact fault, but each gives you a smaller stretch of system to inspect.

Apply the same check when an anomaly detector produces the assessment. Keep the input interval and the relevant configuration or model version with the result. That lets a reviewer tell the difference between a changed assessment of the same input and a change in the service's behavior. Mark the assessment unavailable when it can't be evaluated, so responders know to use their fallback.

After recovery, compare the time the service changed, the time monitoring could see it, and the time somebody could act. The detection and response guide follows those clocks when a report makes only one of them look faster.

At 09:10, the customer and the dashboard can both be right about the moments they describe. Put the age back beside the zero, and the old reading stops settling the question. You can get a current checkout result while the monitoring owner follows the missing nine minutes to the evaluator.

Source context

Source links appear within this article. Read them alongside the author’s analysis and evaluate the guidance against your environment.

Report an error or outdated detail

Keep reading

Where to go next