Soru

Zorluk: ZorIncident Management and Automated Alerting

Your organization operates a real-time transaction processing API on Google Cloud. To maintain strict reliability standards, you are implementing an automated incident management and escalation workflow using Google Cloud Observability tools. Order the operational steps sequentially from initial anomaly detection to full incident resolution and notification.

  1. 1Cloud Monitoring evaluates incoming latency metrics and detects a 14-day SLO error budget burn rate exceeding the critical alerting threshold.
  2. 2Cloud Monitoring publishes an incident notification event to a designated Pub/Sub topic configured as an automated notification channel.
  3. 3An event-driven Cloud Run service receives the Pub/Sub event and automatically executes remediation scripts to provision fallback capacity.
  4. 4Cloud Monitoring observes that latency SLIs fall back below the alert threshold, automatically closes the incident, and notifies the operations team of resolution.

Cevap

The correct sequence starts with Cloud Monitoring detecting an SLO error budget burn rate breach, followed by publishing an alert event to a Pub/Sub topic notification channel, triggering an automated Cloud Run remediation service to restore performance capacity, and concluding with Cloud Monitoring verifying metric recovery and resolving the incident.
In GCP Site Reliability Engineering practices, incident management starts with metric-driven anomaly detection (SLO burn rate evaluation). Upon detecting a breach, Cloud Monitoring uses Pub/Sub notification channels to asynchronously trigger automated remediation code (such as Cloud Run or Cloud Functions). Once the automated action restores service metrics, Cloud Monitoring validates recovery and marks the incident resolved.

Adım Adım Çözüm

1
Detect metric anomaly using SLO burn rate alerting policy
An alert incident is created in Cloud Monitoring when latency SLIs breach the error budget threshold.
Incident response workflows begin with automated threshold detection based on SLIs/SLOs.
2
Dispatch incident payload to automated notification channel
A structured incident message is delivered to a GCP Pub/Sub topic.
Pub/Sub serves as an asynchronous event bus decoupler for downstream automated remediation.
3
Trigger event-driven remediation service
Cloud Run consumes the Pub/Sub message and executes mitigation steps to scale up compute infrastructure.
Automated response minimizes Mean Time to Resolution (MTTR) before human escalation.
4
Verify metric stabilization and auto-close incident
Cloud Monitoring registers normal SLI levels, closes the open incident, and logs final resolution.
Alert policies automatically mark incidents resolved once conditions return below threshold levels for the re-evaluation duration.

Anahtar Kavram

Event-driven automated incident management and escalation pipelines using Cloud Monitoring, Pub/Sub, and Cloud Run.
Bu soruyu puanla