On this page
The checklist in one paragraph
Redis is ready for production when six things are true. Memory: maxmemory is set below host memory with headroom for the fork at save time, and the eviction policy was chosen on purpose. Persistence: the mode matches what you can afford to lose, and a snapshot leaves the machine every day and has been restored at least once. Failover: replicas exist, Sentinel runs three instances on independent hosts or Cluster has at least three primaries, and you have killed a primary with clients connected and timed the recovery. Security: nothing reachable from the internet, ACL users instead of the open default user, dangerous commands denied. Clients: the latency monitor is on, nothing runs KEYS, pools and maxclients are sized. Operations: alerts on trends, a rehearsed upgrade path and a named escalation contact. Every check below applies to Valkey as well.
How to use this checklist, and how it was built
Run the checks in order on the instance as it will run in production, and treat any row that fails as a go-live blocker until you have decided to accept the risk in writing. The first three groups cover what loses data or takes the instance down, so they come first. Every row comes from one of two places: a setting the Redis documentation tells you to apply, or a failure pattern we see repeatedly in support work. Commands and defaults were read from redis.io on 28 October 2026: the administration, persistence, replication, Sentinel, scaling, security, ACL and client-handling pages. Where a row is our own advice rather than a documented rule, it says so.
Memory and host: set the ceiling, leave room for the fork (checks 1 to 7)
Most first outages are memory: a full instance with the default eviction policy, or a fork at save time that doubles usage. These seven checks set the ceiling and the headroom around it.
| Check | How to verify | Passes when |
|---|---|---|
1. Explicit maxmemory | redis-cli CONFIG GET maxmemory | Not 0. Set below host memory after allowing for overhead and fragmentation; the Redis administration guide says that if you think you have 10 GB free, set it to 8 or 9. |
| 2. Eviction policy chosen on purpose | CONFIG GET maxmemory-policy; INFO stats for evicted_keys | An LRU or LFU policy for a cache; noeviction only where a write error is better than losing a key. The default is noeviction. |
| 3. Headroom for the save peak | INFO persistence: rdb_last_cow_size | Host memory covers up to 2 times normal usage on a write-heavy instance while it saves an RDB file or rewrites the AOF, as the administration guide warns. |
| 4. Overcommit set to 1 | sysctl vm.overcommit_memory | Returns 1, set in /etc/sysctl.conf so it survives a reboot. |
| 5. Transparent huge pages off | cat /sys/kernel/mm/transparent_hugepage/enabled | Shows [never]. The administration guide gives this setting to protect memory use and latency. |
| 6. Swap enabled and watched | free -m; vmstat 1 (si and so columns) | Swap exists, as the administration guide advises, so a memory spike shows up as latency you can alert on instead of an out-of-memory kill. |
| 7. Client memory capped | CONFIG GET maxmemory-clients | Non-zero on any large deployment. The client-handling page says client eviction is off by default and suggests 5% as a starting point; it needs Redis 7.0 or later. |
From our engagements. A pattern we see in support work is a maxmemory chosen at go-live that no one revisited as the dataset and replication buffers grew, so the first outage arrives at the busiest hour. On a real-time screen-sharing platform, a misconfigured 7 GB memory ceiling forced evictions well before the hardware limit, and Redis Search slowed under high-frequency writes; correcting the ceiling and rotating degraded instances restored stability (the engagement).
Persistence and backups: decide what you can lose, then restore once (checks 8 to 12)
Persistence decides how much you lose when Redis stops, and backups decide whether you can recover when the disk does not survive. The Redis documentation is blunt about it: no backups means a huge risk of data disappearing.
| Check | How to verify | Passes when |
|---|---|---|
| 8. Persistence mode chosen | CONFIG GET save; CONFIG GET appendonly | RDB alone if a few minutes of loss is acceptable; RDB plus AOF for PostgreSQL-like safety, which the persistence page recommends; none for a pure cache. The page discourages AOF alone. |
| 9. AOF fsync policy is deliberate | CONFIG GET appendfsync | everysec (the default) if losing up to one second of writes is acceptable; always only where you accept the write cost. |
| 10. No empty restart under replication | Restart policy of the service or container; CONFIG GET appendonly | Either the primary persists, or it does not restart automatically. The replication page describes a primary that restarts empty and wipes its replicas. |
| 11. A snapshot leaves the machine every day | Backup job logs; file size and checksum at the destination | At least one RDB snapshot a day lands outside the physical machine, as the persistence page suggests, and a failed transfer raises an alert. |
| 12. A restore has been run | Restore the latest snapshot to a scratch instance; compare DBSIZE | The restored instance starts and holds the expected key count. This check is our advice: the documentation tells you to back up, and a restore is the only proof the backup works. |
The empty-restart failure in check 10 costs nothing to prevent: one line in the runbook says either that the primary persists or that it is never restarted automatically.
Replication and failover: replicas, quorum and a rehearsed failure (checks 13 to 19)
Replicas protect against a lost node only if the quorum is placed so it survives that loss and clients follow the new primary. Redis replication is asynchronous, so acknowledged writes can still be lost in a failover, and the point of these seven checks is to bound that and to prove the recovery time.
| Check | How to verify | Passes when |
|---|---|---|
| 13. Replicas exist and are read-only | INFO replication; CONFIG GET replica-read-only | At least one connected replica per primary; replica-read-only is yes (the default). |
| 14. Replication backlog sized | CONFIG GET repl-backlog-size; INFO stats for sync_full and sync_partial_ok | A non-trivial backlog in proportion to memory, as the administration guide advises, and full resyncs are rare after short disconnects. |
| 15. Write-loss window bounded | CONFIG GET min-replicas-to-write and min-replicas-max-lag | Set if you want writes refused when too few replicas are within a maximum lag. The replication page calls it best effort: it narrows the window, it does not remove it. |
| 16. Sentinel: three instances on independent hosts | SENTINEL masters; SENTINEL sentinels <name> | At least three Sentinels on machines that fail independently, such as different hosts or availability zones, with port 26379 open between them. |
| 17. Cluster: at least three primaries | CLUSTER INFO; CLUSTER NODES | At least three primaries; the scaling page recommends six nodes, three primaries and three replicas. cluster-require-full-coverage (default yes) is a choice you have made. |
| 18. Failover rehearsed with clients connected | redis-cli -p 6379 DEBUG sleep 30 on a primary in a test estate, with the application running | A replica is promoted, clients reconnect to the new primary, and you have a measured recovery time. The Sentinel documentation shows this test; timing it is our advice. |
| 19. Replica memory watched | INFO memory on each replica | Replicas ignore maxmemory by default, so each has room to stay below real memory before the primary hits its ceiling. |
Check 18 is the one most teams skip. Kill a primary with clients connected and watch how long promotion takes, whether clients reconnect to the new primary or keep writing to a stale one, and what the application does with the writes in flight. The time you measure is your real recovery time.
Security: Redis trusts its clients, so the network and ACLs carry the weight (checks 20 to 23)
Redis is built to be reached by trusted clients inside trusted environments, so a safe deployment is one where untrusted traffic cannot reach the port and every client has the least access it needs. The default user, out of the box, can run every command on every key with no password.
| Check | How to verify | Passes when |
|---|---|---|
| 20. Not reachable from the internet | CONFIG GET bind; firewall or security-group rules; an external port scan | Only the application hosts can reach the Redis port. Protected mode, available since 3.2.0, only covers an instance with the default configuration and no password, so it is a backstop and not a plan. |
| 21. ACL users, with the open default user closed | ACL LIST | No default ... nopass ~* +@all line, which is how a fresh instance ships. Each application has its own user with only the commands and key patterns it needs. |
| 22. TLS where traffic crosses a network you do not control | CONFIG GET tls-port; redis-cli --tls | TLS on client links, replication links and the Cluster bus where the path is not fully private. The documentation notes that AUTH alone is sent unencrypted. |
| 23. Dangerous commands denied to application users | ACL GETUSER <app-user> | Application users hold -@dangerous or an explicit deny of FLUSHALL, FLUSHDB and CONFIG. Key patterns do not stop FLUSHALL, as the ACL page warns, and Redis runs as an unprivileged user. |
The documentation marks the older rename-command method as deprecated in favour of ACL rules, so use ACLs for check 23.
Clients and latency: make slowness visible before users report it (checks 24 to 27)
Redis serves commands one at a time, so one slow command or one exhausted connection pool looks like an outage while the server reports healthy. These four checks make that visible.
| Check | How to verify | Passes when |
|---|---|---|
| 24. Latency monitor and slow log on | CONFIG GET latency-monitor-threshold; SLOWLOG GET 10 | Latency monitoring is off by default. Set a threshold such as CONFIG SET latency-monitor-threshold 100, the example in the Redis documentation, and read LATENCY DOCTOR. |
25. Nothing runs KEYS in production | SLOWLOG GET; code search for KEYS | Iteration uses SCAN and its variants. Large collections are split, and no command in the slow log scans the keyspace. |
26. maxclients fits the file-descriptor limit | CONFIG GET maxclients; ulimit -n for the Redis process | The default is 10,000. If the process limit is lower, Redis lowers the client limit to match and logs it at startup, so set ulimit to match what you configure. |
| 27. Pools and timeouts sized above peak concurrency | CLIENT LIST; client library configuration | Pool size exceeds peak concurrency, idle connections are bounded, and TCP keepalive (about 300 seconds by default since 3.2) is left on. A pool that is too small queues on the client and looks like a server timeout. |
From our engagements. On .NET microservices behind a banking application, AceMQ traced intermittent 10-second Redis connection timeouts to the clients: connection pool exhaustion and misconfiguration, and synchronous blocking patterns, not Redis capacity (the timeout case). A second pattern we see is latency that climbs under sustained load on small cloud cache nodes sized for a test and left in production.
Operations: alerts, upgrades and a person to call (checks 28 to 30)
The instance stays production-ready only if someone is told when it drifts and knows the next step. These three checks cover monitoring, the upgrade path and the escalation route.
| Check | How to verify | Passes when |
|---|---|---|
| 28. Supported version and a rehearsed upgrade | INFO server for redis_version; the end-of-life table | You run a version that still receives fixes, and you have upgraded replicas one after another and promoted an upgraded replica with a manual failover on a copy, which is the method the administration guide gives. |
| 29. Alerts on trends, not on the limit | Your monitoring tool, reading INFO | Alerts on used_memory against maxmemory, a rising evicted_keys, rdb_last_bgsave_status and aof_last_write_status not ok, master_link_status down, connected_clients against maxclients, and growing latest_fork_usec. |
| 30. A runbook and an escalation contact | Read the runbook with someone who did not write it | It names who is on call, the first five commands to run, which steps are unsafe without help (replication, persistence and cluster topology changes), and who to call when the fix is not in the runbook. |
Supported versions and dates change, so check them against the Redis end-of-life table and keep it with the runbook.
What to do when checks fail, and where AceMQ is not the answer
If one or two checks fail, fix them yourself: most are one setting and a test. If checks 16 to 18 or 8 to 12 fail, treat go-live as blocked, because those are the ones that lose data or leave you without a tested way back. AceMQ has been in business for more than 10 years, supports 160+ customers, and handles 40+ Sev 1 incidents a year. A Redis health check reads these signals on your deployment, ranks the findings by what will fail first and ends in a written fix list. 24/7 support carries a 15-minute emergency response, and a quote request is answered within 1 hour.
Where we are not the right fit. If your Redis is a small cache on a managed cloud service and your team is comfortable owning it, the checklist above is enough and you do not need us. Several rows, such as the host settings in checks 4 to 6, do not apply to a managed service at all, and the cloud provider's support tier covers the service itself. Regular support from AceMQ is priced at $24,000 to $72,000 a year by SLA, scope and deployment, with aggressive multi-technology discounts, so it suits production estates where an outage costs more than that.
Frequently asked questions
What should I check before putting Redis into production?
Set maxmemory and an eviction policy, choose a persistence mode and restore one backup, run replicas with Sentinel on three independent hosts or a Cluster with at least three primaries, rehearse a failover, close network and ACL access, turn on the latency monitor, and set alerts on memory, replication and persistence status.
How much memory headroom does Redis need in production?
Set maxmemory below host memory with room for overhead and fragmentation, for example 8 or 9 GB on a host with 10 GB free. On a write-heavy instance, Redis can use up to 2 times its normal memory while it saves an RDB file or rewrites the AOF, so size for that peak.
Do I need Redis Sentinel or Redis Cluster?
Sentinel gives one replicated dataset with automatic failover and needs at least three Sentinel instances on independent machines. Cluster shards the dataset and needs at least three primaries; the documentation recommends six nodes, three primaries and three replicas.
Is the default Redis configuration safe for production?
No. A fresh instance has an open default user with no password, no memory ceiling, the noeviction policy and the latency monitor off. Protected mode stops remote access only while the instance is bound to all interfaces with no password, so firewall the port and use ACL users.
Does this checklist apply to Valkey and managed Redis?
It applies to Valkey, which forked from Redis 7.2 and shares these commands and settings. On a managed service such as ElastiCache or Azure Managed Redis, the host and operating-system checks belong to the provider, but memory policy, persistence settings the service exposes, client pools, alerts and the runbook stay with you.