Skip to content

v0.8.0

Latest

Choose a tag to compare

@zw008 zw008 released this 03 Aug 05:46

Fixed

  • The error-burst RCA could not see a large burst. Per-stream error counts were the row count of a query_range bounded at 100 lines, so every busy stream reported exactly 100 and the current-vs-baseline comparison collapsed. A service going from 25 to 485 errors read as 100 → 100 — no burst — and so did a service that had been noisy all along, meaning the analysis failed precisely when the incident was big. Counts now come from Loki's own count_over_time, evaluated server-side and exact at any volume; the bounded line query is used only for sample lines, and a stream crowded out of it is still reported with its real count and no samples. Verified against a live Loki 3.0.0: the same seeded 19x spike scores burstCount: 0 before the fix and volume_spike after.
  • undo apply replays against the target the original write ran on. It dispatched the inverse against whatever target the caller named — in practice the config's first entry — while the write's own target sat unused in the undo record. On a multi-target config the inverse therefore ran against the wrong host; it only looks harmless because the resource usually is not there, but two hosts holding the same name and the inverse succeeds on the wrong one, silently. An explicitly named target still wins. Line-wide: all 24 copies had the identical defect. Caught live in container-host-aiops, where a stop recorded against a Podman target replayed against a Portainer one.