Frigga Blogs

At 11:20 UTC on 18 November 2025, Cloudflare's core network started failing. Within minutes X, ChatGPT, Spotify and Canva were returning errors, and a decent slice of the internet stopped working. Inside Cloudflare, the first theory was a hyper-…

Watch the first two minutes of any investigation and you will notice that almost none of it is investigation. An alert fires for a service. Before anybody can reason about what went wrong, somebody has to establish what the service even is. Which clus…

The thing nobody warns you about with your first few incidents isn't the pressure. It's the tab count. You start with an alert. By minute four you've got Grafana open, a terminal running kubectl , your CI system in another tab, GitHub in…

A node memory alert goes off. The question that follows is always the same, and it's never as easy to answer as it should be. Which workload is doing this? The usual route is kubectl top pods , sorted by hand, one namespace at a time. If you…

Every investigation I have been part of needs two kinds of knowledge, and they never live in the same place. The first is what production is doing. Error rate, latency, memory, what deployed and when, which pods are unhappy. That is Grafana, or Data…

Watch how an investigation actually begins. An alert fires. Somebody in the channel says "I bet it's the database." Within ninety seconds four people are looking at database metrics, somebody is checking connection pool saturation, and a…

There is a question that stalls almost every incident I have been part of, and it arrives about four minutes in. Something is failing. You have found the service responsible. Then somebody asks what else touches it, and the room goes quiet. Two peop…

Open your Grafana instance and look at the list. Not the two or three you actually use. The whole list. Most of those panels have an origin story, and it is nearly always the same one. Something broke, nobody could see it while it was happening, and…