tag
7 posts
A correct mental model for macOS FSEvents streams, path coalescing, event IDs, per-disk persistence, dropped-event flags, exclusions, and rescanning.
A production WEF workflow covering collector-initiated and source-initiated subscriptions, WinRM, event sizing, SDDL, filtering, buffering, and proof.
Deploy and validate kube-prometheus-stack with persistent storage, secure Grafana access, bounded cardinality, alert routing, and recovery tests.
Configuring the Linux audit daemon to watch specific files, commands, and syscalls, then actually query the resulting logs for something useful.
Read ProcessController's CPU and memory indicators correctly, inspect teams and threads, capture evidence, and avoid destructive controls.
How the three pillars of observability complement each other, and why having all three matters more than maximizing any single one.
A practical toolkit for watching CPU, memory, disk, and network usage live — going beyond top to actually find what's causing a resource problem.