Overview
A typical review starts when several teams each run their own Prometheus, a log cluster has grown past its owner and a dashboard estate has no map. AceMQ reads what runs today, what each team needs from it and what the organisation can operate, and returns a written stack decision and operating model.
Challenge
Each team chose for its own services: one Prometheus per cluster with local retention only, a search cluster holding logs with shards sized by default, and dashboards that query three different sources under different label names. No one owns a label policy, retention is whatever the disk allows, alerts fire in batches, and the platforms that carry the messaging and databases are monitored in a separate place.
Environment
Several Kubernetes clusters and a set of virtual machines, a Prometheus server in each, one OpenSearch cluster for logs, Grafana in front of both, and RabbitMQ, Kafka and PostgreSQL as the platforms underneath the services.
Approach
AceMQ builds an inventory of sources, tools and owners, measures series and log volume by source, and compares the options against it: Prometheus alone or with Thanos or Mimir for metrics, OpenSearch or Loki for logs, Tempo or Jaeger for traces, with OpenTelemetry in the collection layer. The review ends in a decision record and an agreed operating model.
Solution
- Inventory of every collector, store and dashboard source, with an owner and a cost to run for each
- A label policy and series limits, with the rule for who may add a label and where it is enforced
- Retention sized from the sample rate and ingest volume, with the point where Thanos or Mimir becomes necessary stated in numbers from the estate
- A shard and index lifecycle plan for the log cluster, including snapshots and a restore test
- RabbitMQ, Kafka and PostgreSQL signals added to the same stack, with alerts routed to the team that owns each platform
- An operating model that names who holds the pager for the stack itself and which of the four support tiers applies
Outcome
The customer ends up with one written stack decision instead of several tool choices, a label and retention policy its engineers have reviewed, an alert routing design and an agreed owner for each layer, including the monitoring stack itself.