Plain-language definitions of observability, logging, incident and security terms.
Alert fatigue is when too many low-value alerts make on-call engineers slower to react to real ones. See the causes, Google SRE rules, and a fix checklist.
Application performance monitoring (APM) tracks the speed, errors, and dependencies of a running app. See what it covers, how data arrives, and its limits.
Blue/green deployment runs two identical environments and switches traffic between them. See how it works, how rollback works, and the database caveat.
A canary deployment sends a new release to a small share of production traffic first. See how it works, which metrics to judge it by, and how it compares.
Cardinality is the number of unique label combinations a metric has, and each one is a time series. See the math, Prometheus guidance, and how to cap it.
The four golden signals are latency, traffic, errors, and saturation. See what each means, how to query them from logs or Prometheus, and common mistakes.
The incident response lifecycle is how an incident is handled from prep to review. See NIST Rev. 2's four phases, what Rev. 3 changed, and Google's model.
Incident severity levels rank an incident by impact so you know who to wake and how fast to act. See example definitions based on NIST and AWS guidance.
Log levels label how severe a log message is. See the standard levels, numeric values in Python, syslog, and OpenTelemetry, and how to pick one.
MTTR stands for four different things: repair, recovery, respond, and resolve. See how each is measured, the formula, SQL to compute it, and how MTTA fits.
On-call means being reachable to respond to production problems outside normal work. See how rotations, paging response times, and pager load work.
p95 latency is the response time 95% of requests beat. See why averages mislead, how to compute p95 from logs in SQL, and how histograms estimate it.
An incident postmortem is a written record of what happened, why, and what changes. See Google's format, when to write one, and what blameless means.
Real user monitoring (RUM) measures performance in real visitors' browsers and apps. See how it works, Core Web Vitals thresholds, and RUM vs synthetic.
Root cause analysis finds the underlying reason an incident happened, not just the trigger. See the 5 whys method, a worked example, and common mistakes.
A runbook is a documented, step-by-step procedure for a specific task or fix. See how it differs from a playbook, what to include, and how to automate it.
An SLA is a contract with consequences, an SLO is an internal target, an SLI is the measurement. See how they relate, with a real SLA credit table.
Synthetic monitoring runs scripted checks against your app on a schedule. See how it works, its limits, and how it differs from real user monitoring (RUM).
Trace sampling keeps a fraction of traces to cut cost. Compare head sampling and tail sampling, see OpenTelemetry settings, and avoid broken traces.
USE checks resources (utilization, saturation, errors). RED checks services (rate, errors, duration). See how they differ, overlap, and combine.
W3C Trace Context is the standard HTTP header format for passing a trace between services. Field-by-field breakdown of traceparent and tracestate.
IOCs are technical artifacts suggesting an attack is underway or has happened. See IOC types, how they differ from TTPs, and how to hunt for them in logs.
A correlation ID ties together the log lines from every service a request touches. See how it differs from a trace ID and how to implement one.
A CVE is a unique ID for a publicly known security vulnerability, such as CVE-2021-44228. Learn the ID format, who assigns it, and how to look one up.
A SIEM collects logs from many sources, correlates events, and flags what matters. See how it works, what it ingests, and how it differs from log tools.
A span is one timed operation inside a trace. See what fields a span holds, how span kind and status work, and how spans nest into a trace.
A trace ID is the identifier shared by every span and log line in one request. See the W3C format, an example, and how to log it.
A zero-day is a vulnerability attackers use before a fix exists. See the NIST definition, what defenders can do with no patch, and how zero-days reach KEV.
Account takeover is an attacker gaining control of a legitimate account. See how it happens, the log events that show it, and how to contain it.
An audit log is a chronological record of who did what, where, and when. See CloudTrail, Kubernetes, and Linux examples, plus what to protect and keep.
An error budget is the unreliability your SLO allows: 100% minus the target. See the formula, worked examples, burn rate alert thresholds, and a policy.
An SBOM is a nested inventory of the components inside software. See the 2026 minimum elements, SPDX vs CycloneDX, and how an SBOM finds vulnerable code.
A service level indicator (SLI) measures user-facing service quality, usually good events over valid events. See SLI examples and SQL to compute them.
A service level objective (SLO) is a target for a reliability measurement over a time window. Learn how to write one, pick the number, and see examples.
Apdex turns response times into a 0 to 1 satisfaction score from a threshold T. See the formula, rating bands, SQL and PromQL, and its limits.
Credential stuffing tests stolen username and password pairs against your login. See how it differs from brute force, the log signs, and the defenses.
Cryptojacking is hijacking someone else's computing power to mine cryptocurrency. See how it hits cloud and containers, and the log signs to watch.
CVSS rates vulnerability severity from 0.0 to 10.0. See the v4.0 metric groups, the severity scale, how to read a vector string, and what scores omit.
Data exfiltration is the unauthorized transfer of data out of a system. See attacker methods, the cloud and network log signs, and how to reduce risk.
Distributed tracing follows one request across services as a tree of timed spans. Learn how context propagation works, with an example and pitfalls.
EPSS estimates the chance a CVE is exploited in the wild in the next 30 days. See how to read the score and percentile, query the API, and set a threshold.
Lateral movement is how an attacker moves from one compromised system to others. See the ATT&CK techniques, log signs, and ways to limit it.
Log aggregation collects logs from many hosts and services into one searchable place. See the three tiers, agent and gateway roles, and a config example.
Log forwarding, also called log shipping, moves logs from where they are written to a central system. See agents, buffering, delivery limits, and configs.
Log parsing extracts fields from raw log lines so you can filter and count them. See regex, grok, and JSON parsing examples with working code.
Log retention is how long you keep logs before deleting them. See NIST and OWASP guidance, how to set a policy, and examples from CloudTrail and Sazabi.
Log4Shell (CVE-2021-44228) is a critical Apache Log4j flaw that let attackers run code through log messages. See fixed versions, log signs, and lessons.
MTBF is the average operating time between failures of a repairable system. See the formula, its link to MTTR and availability, and its limits.
MTTD is the average time between a problem starting and anyone finding out. See the formula, how to find the true start in logs, and how to cut it.
Observability is the ability to understand a system from the data it emits. Observability vs monitoring, and the three pillars: logs, metrics, and traces.
OpenTelemetry is the open source, vendor-neutral standard for generating traces, metrics, and logs. What it includes, what it is not, and how data flows.
OTLP is the OpenTelemetry Protocol for sending traces, metrics, and logs. See the gRPC and HTTP transports, ports 4317 and 4318, paths, and errors.
Privilege escalation is gaining higher permissions than you were given. See ATT&CK techniques, cloud and Linux examples, and the log lines that show it.
Structured logging writes each event as named fields, usually JSON, so tools can filter without regex. See an example, a Python formatter, and field rules.
Syslog is the standard message format and protocol for system logs. See the RFC 5424 fields, PRI math, facilities, severities, and a parsed example.
Telemetry is data a system emits about its own behavior: logs, metrics, and traces. Learn the types, how it is collected, and what to watch for.
The CISA KEV catalog lists vulnerabilities with reliable evidence of exploitation in the wild. See the three criteria, the fields, and how to prioritize.