SLO and Error Budget Service  ·  View 17 of 21  ·  Operations

Observability

Signal type by pipeline stage, and the row that exists because nothing else can see it.

Editable source SVG draw.io All views
Ingest Compute Publish Alert Policy The alert Oldest unbucketed minute > 10 min pages Projection staleness > 120 s pages Verdict error rate Evaluation lag Override rate weekly review Metrics Buckets/s by source Late fraction Watermark lag Recompute minutes Verdict p99 Cache hit rate Rules evaluated/min Pages per rotation Exclusion minutes Logs and traces Quarantine reasons Window close record Signed verdict log Alert decision inputs Audit ledger The platform's own SLOs Bucket freshness p95 60 s Recompute within 90 s Verdict availability 99.95% Detection within 5 min Two-approver compliance What nothing else sees Coverage per SLO the blind-SLO signal Shadow divergence Insufficient-data rate Page precision vs incident records Exception frequency Observability — Signal Type by Pipeline Stage The bottom row is the reason this view exists. A platform that is up, fast and wrong passes every row above it: only coverage, shadow divergence and page precision can tell you that the arithmetic has quietly stopped describing anything. v 1.0 · owner Reliability Architecture · date 2026-10

Decisions

  • The bottom row is why this view exists. A platform that is up, fast and wrong passes every row above it: only coverage, shadow divergence and page precision can show that the arithmetic has stopped describing anything (ADR-04).
  • Oldest-unbucketed-minute age is the paging signal on ingest, because a pipeline that is up and not producing buckets passes every health check.
  • The platform's own SLOs are computed by the same engine, with the watchdog as the independent check that the engine is answering at all (ADR-17).

Targets

  • Projection staleness pages above 120 s; oldest unbucketed minute pages above 10 minutes — assumed.
  • Alert decision records retained 13 months, with the inputs, so precision is computable retrospectively.
  • Override rate reviewed weekly rather than alerted, since the signal is a trend rather than an event.

Risks

  • Self-measurement is circular by construction. The watchdog bounds the circularity but cannot remove it: a correlated failure of platform and watchdog is undetected until a human notices.
  • Page precision depends on the incident platform's records being complete. An unrecorded incident makes a correct page look like a false one.
◀  Deployment Architecture All views SLO Lifecycle  ▶
Solution Architecture v1.0 · Microsoft Azure · Reliability Architecture · 2026-10 · 21 views · 17 architecture decision records17-observability