Intelligence · Incident Correlation
Many signals, one incident.
A replica falling behind, a buffer pool hit rate dropping and a query slowing are usually one event described three times. Correlation collapses them into a single incident with the relationship stated.
How correlation works
A policy engine, not a static rule list
Incident policies decide what constitutes an incident for a given scope, so a threshold that matters on a primary can be noise on a reporting replica.
Topology is part of the correlation
Signals from members of the same cluster are related by construction. Correlation that ignores topology produces three incidents for one failover.
The event history stays attached
An incident carries the sequence that produced it, so the post-mortem is reading rather than reconstruction.
Ownership and comments
Assignment and threaded comments make the incident the record, rather than a chat thread nobody can find afterwards.
Related