[{"data":1,"prerenderedAt":602},["ShallowReactive",2],{"insight-cloudflare-observability":3,"insights-cards":492},{"id":4,"title":5,"body":6,"category":474,"date":475,"description":476,"extension":477,"meta":478,"navigation":379,"path":479,"readingTime":480,"relatedArticles":481,"relatedAssessment":485,"relatedServices":486,"seo":489,"stem":490,"__hash__":491},"insights\u002Finsights\u002Fcloudflare-observability.md","The Cloudflare Signals You Need Wired Up Before Something Breaks",{"type":7,"value":8,"toc":459},"minimark",[9,13,18,21,28,34,40,43,47,50,78,81,85,88,94,100,106,112,120,124,127,262,265,269,275,281,285,288,291,324,327,330,334,337,351,355,358,361,365,368,442,446,449,452,456],[10,11,12],"p",{},"Observability at the edge has a deadline, and the deadline is the start of the incident. Retention you did not configure, thresholds you did not choose and alert routes you did not test cannot be added retroactively. The work that decides how an outage goes is done weeks earlier, when nothing is on fire and nobody feels like doing it.",[14,15,17],"h2",{"id":16},"three-jobs-that-get-confused-with-each-other","Three jobs that get confused with each other",[10,19,20],{},"Teams say \"we have observability\" when they mean one of three different things. It helps to separate them, because each one is built from a different part of the platform and each one fails in its own way.",[10,22,23,27],{},[24,25,26],"strong",{},"Detection"," is a person finding out that something is wrong, soon enough to matter. It is built from alerts and from checks that run continuously. It fails silently: you only learn it was missing when a customer tells you first.",[10,29,30,33],{},[24,31,32],{},"Diagnosis"," is narrowing the problem down while it is still happening. Is it one origin or all of them? One path? One country? One customer? It is built from analytics you can slice quickly and from live log access. It fails when the dashboard can only show you a total.",[10,35,36,39],{},[24,37,38],{},"Reconstruction"," is the timeline you write afterward: what changed, who was affected, for how long. It is built from retained raw logs. It fails when the logs were never exported, or were exported without the fields you now need.",[10,41,42],{},"Most accounts are reasonably good at the third, partial on the second and thin on the first. That ordering is the reverse of what the business cares about.",[14,44,46],{"id":45},"what-the-defaults-give-you-and-where-they-stop","What the defaults give you, and where they stop",[10,48,49],{},"Turn on a zone and you get dashboards for traffic, cache, security events and performance without doing anything. This is real value. It is also bounded in ways that only matter under pressure:",[51,52,53,60,66,72],"ul",{},[54,55,56,59],"li",{},[24,57,58],{},"Aggregated analytics are often sampled."," They are excellent for shape and trend, and less reliable for answering \"exactly which 40 requests failed for this customer\".",[54,61,62,65],{},[24,63,64],{},"History is limited by plan."," How far back you can look in the dashboard depends on what you pay for. If you need to compare today with the same weekday last quarter, check that the window actually reaches that far.",[54,67,68,71],{},[24,69,70],{},"Raw request logs are not kept for you by default."," To hold per-request records for later, you have to push them somewhere or enable a product that stores them. This is the single most common surprise in a postmortem.",[54,73,74,77],{},[24,75,76],{},"Nothing pages anyone by default."," A dashboard is a place to look after you already suspect a problem.",[10,79,80],{},"None of that is a criticism of the platform. A default cannot know which of your endpoints carries revenue, or what \"normal\" means for your traffic on a Monday morning.",[14,82,84],{"id":83},"decide-log-retention-while-you-still-can","Decide log retention while you still can",[10,86,87],{},"Log export is the one piece you cannot improvise. Cloudflare's log push mechanism delivers batches of log records to a destination you control, such as object storage or a SIEM. Set it up in calm conditions and make four decisions deliberately.",[10,89,90,93],{},[24,91,92],{},"Which datasets."," HTTP requests is the obvious one. Firewall or security events, DNS logs, audit logs of account changes and, if you run code at the edge, Workers trace events all answer different questions. The account audit log deserves special mention: a large share of incidents begin with a configuration change, and \"who changed which rule at 14:02\" is often the fastest route to a fix.",[10,95,96,99],{},[24,97,98],{},"Which fields."," Export jobs let you choose fields, and the defaults are not always enough. For request logs, make sure you have the edge response status and the origin response status as separate fields, the cache status, the origin response time, the security action taken and the rule that took it, and the Ray ID.",[10,101,102,105],{},[24,103,104],{},"How long."," Pick a retention period on purpose. Thirty days covers most operational questions. Security investigations and compliance obligations often need much longer. Storage is cheap compared with not having the data.",[10,107,108,111],{},[24,109,110],{},"What must not be in there."," Request logs can contain query strings, headers and client IPs. If your URLs carry tokens, email addresses or health information, your log bucket has just become a sensitive data store. Fix the URLs, drop the fields, or apply the same access controls you apply to the primary database.",[10,113,114,115,119],{},"One practical habit pays for itself the first time you use it: log the ",[116,117,118],"code",{},"CF-Ray"," request header at your origin. That one identifier lets you join an edge log line to the application log line for the same request, which turns \"the edge says 502, the app says nothing\" into an answer.",[14,121,123],{"id":122},"the-short-list-of-signals-worth-interrupting-someone-for","The short list of signals worth interrupting someone for",[10,125,126],{},"An alert is a claim that a human should stop what they are doing. Very few signals justify that. The table below is a starting set, not a complete one.",[128,129,130,149],"table",{},[131,132,133],"thead",{},[134,135,136,140,143,146],"tr",{},[137,138,139],"th",{},"Signal",[137,141,142],{},"What it usually means",[137,144,145],{},"Where the data lives",[137,147,148],{},"Response",[150,151,152,167,180,193,207,220,234,248],"tbody",{},[134,153,154,158,161,164],{},[155,156,157],"td",{},"5xx rate on a revenue path (checkout, login, core API) above a set percentage for several minutes",[155,159,160],{},"Origin failure, bad deploy, dependency down",[155,162,163],{},"Request analytics, origin status in logs",[155,165,166],{},"Page",[134,168,169,172,175,178],{},[155,170,171],{},"Origin unreachable or timing out (the 52x family of edge errors)",[155,173,174],{},"Network path, firewall change, origin overload, expired origin certificate",[155,176,177],{},"Edge status codes, health checks",[155,179,166],{},[134,181,182,185,188,191],{},[155,183,184],{},"Health check failing from multiple regions",[155,186,187],{},"Origin or pool is actually down",[155,189,190],{},"Health checks, load balancer events",[155,192,166],{},[134,194,195,198,201,204],{},[155,196,197],{},"Sudden rise in blocked or challenged requests on a path real users need",[155,199,200],{},"A rule is hurting legitimate traffic, or an attack is in progress",[155,202,203],{},"Security events",[155,205,206],{},"Page during business hours, ticket otherwise",[134,208,209,212,215,218],{},[155,210,211],{},"Edge code error rate or exceptions rising after a deploy",[155,213,214],{},"Worker regression",[155,216,217],{},"Workers logs and metrics",[155,219,166],{},[134,221,222,225,228,231],{},[155,223,224],{},"Cache hit ratio dropping sharply",[155,226,227],{},"A rule or header change is sending traffic to origin",[155,229,230],{},"Cache analytics",[155,232,233],{},"Ticket, page if origin load follows",[134,235,236,239,242,245],{},[155,237,238],{},"p95 origin response time creeping up week over week",[155,240,241],{},"Capacity, slow query, growing dataset",[155,243,244],{},"Request logs or analytics",[155,246,247],{},"Ticket with an owner",[134,249,250,253,256,259],{},[155,251,252],{},"Certificate nearing expiry, DNS record changed, account setting changed",[155,254,255],{},"Preventable outage or unreviewed change",[155,257,258],{},"Notifications, audit log",[155,260,261],{},"Ticket",[10,263,264],{},"Notice two things. First, every \"page\" row is about user-visible failure, not about resource usage. Second, the rows are scoped to a path or a pool. An alert on the zone-wide error rate is nearly useless on a busy site: a login endpoint can be completely down while the overall number barely moves, because static assets keep succeeding.",[14,266,268],{"id":267},"the-two-failures-that-never-trip-a-simple-threshold","The two failures that never trip a simple threshold",[10,270,271,274],{},[24,272,273],{},"Legitimate traffic being blocked."," When a WAF rule, a rate limit or a bot rule stops a real customer, nothing looks broken. The edge returns a 403 or a challenge, exactly as designed. Your origin sees less traffic and looks healthier. No error budget burns. The only trace is a security event and, eventually, a support ticket or a quiet drop in conversions. To catch it, watch the ratio of mitigated requests to total requests per critical path, and alert on a change in that ratio, not on its absolute value. Also review the top blocking rules weekly. A rule that suddenly accounts for most of your blocks either caught an attack or broke something, and you want to know which.",[10,276,277,280],{},[24,278,279],{},"Slow drift."," A latency that grows three percent a week never crosses a line drawn at \"twice normal\". Static thresholds catch cliffs, not slopes. Drift needs a comparison against a baseline: this week's p95 against the same window four weeks ago, reviewed on a schedule. This does not need a pager. It needs a recurring report with a named owner, which is a less exciting artifact and a more reliable one.",[14,282,284],{"id":283},"tuning-an-ignored-alert-is-worse-than-a-missing-one","Tuning: an ignored alert is worse than a missing one",[10,286,287],{},"The opposite failure is alerting on everything. Within a few weeks the channel is muted, and the one alert that matters arrives into silence.",[10,289,290],{},"A few rules keep the signal credible:",[292,293,294,300,306,312,318],"ol",{},[54,295,296,299],{},[24,297,298],{},"Two tiers only."," A page means act now. A ticket means act this week. Anything that is neither should be a dashboard, not a notification.",[54,301,302,305],{},[24,303,304],{},"Require duration."," A threshold that must hold for several minutes filters out the blips that resolve on their own.",[54,307,308,311],{},[24,309,310],{},"Set a floor on volume."," A 50 percent error rate across four requests at 3 a.m. is noise. Require a minimum request count.",[54,313,314,317],{},[24,315,316],{},"Every alert names an action."," If the on-call person cannot say what they would do on receiving it, delete it or rewrite it.",[54,319,320,323],{},[24,321,322],{},"Review after every page."," Was it real? Was it early enough? Could it have been a ticket? Adjust the threshold the same week.",[10,325,326],{},"A healthy rotation receives a small number of pages, and each one is taken seriously. If people have stopped reacting quickly, the problem is the alert set, not the people.",[10,328,329],{},"Route alerts to where the response happens. Cloudflare notifications can be sent by email and, depending on plan, to webhooks and incident tools. Email to a shared inbox is not an on-call system. Test the route end to end: trigger a test notification and confirm a phone actually rings.",[14,331,333],{"id":332},"edge-code-has-its-own-blind-spots","Edge code has its own blind spots",[10,335,336],{},"If you run Workers, part of your application now lives where your traditional APM cannot see. Treat it like any other service:",[51,338,339,342,345,348],{},[54,340,341],{},"Emit structured logs (JSON, with a request identifier and the route) instead of free text, so they can be filtered later.",[54,343,344],{},"Record custom metrics for the things only you understand, such as \"fallback path used\" or \"upstream retried\". An analytics datastore at the edge is well suited to this kind of high-cardinality counter.",[54,346,347],{},"Watch CPU time and subrequest counts against platform limits. A Worker that fails because it hit a limit looks different from one that threw an exception.",[54,349,350],{},"Tie metrics to deployments. Knowing that the error rate changed at the moment a new version went out shortens diagnosis more than any other single fact.",[14,352,354],{"id":353},"do-not-watch-cloudflare-only-from-inside-cloudflare","Do not watch Cloudflare only from inside Cloudflare",[10,356,357],{},"Everything above depends on the edge reporting on itself. Add at least one view from outside: a synthetic check, run by a separate provider from a few regions, that performs a real transaction against your public hostname. It covers the cases where the edge is fine but your DNS is wrong, where a rule blocks a specific region, or where the platform itself is degraded. Subscribe to the provider's status notifications as well, and send them to the same place as your own alerts.",[10,359,360],{},"Run a second check directly against the origin, bypassing the proxy. During an incident, the first diagnostic question is whether the origin is healthy. Having that answer already on a screen saves ten confused minutes.",[14,362,364],{"id":363},"a-pre-incident-checklist","A pre-incident checklist",[10,366,367],{},"Use this as a working review. Every \"no\" is a task to schedule now.",[51,369,372,382,388,394,400,406,412,418,424,430,436],{"className":370},[371],"contains-task-list",[54,373,376,381],{"className":374},[375],"task-list-item",[377,378],"input",{"disabled":379,"type":380},true,"checkbox"," Request, security and audit logs are exported to storage we control, with a stated retention period.",[54,383,385,387],{"className":384},[375],[377,386],{"disabled":379,"type":380}," Exported fields include edge status, origin status, cache status, origin time, rule ID and Ray ID.",[54,389,391,393],{"className":390},[375],[377,392],{"disabled":379,"type":380}," The origin logs the Ray ID.",[54,395,397,399],{"className":396},[375],[377,398],{"disabled":379,"type":380}," We have listed our critical paths, and each has an error-rate alert with a duration and a volume floor.",[54,401,403,405],{"className":402},[375],[377,404],{"disabled":379,"type":380}," Health checks run against every origin from more than one region.",[54,407,409,411],{"className":408},[375],[377,410],{"disabled":379,"type":380}," We track mitigated-versus-total requests on critical paths.",[54,413,415,417],{"className":414},[375],[377,416],{"disabled":379,"type":380}," Someone reviews latency and cache trends on a schedule.",[54,419,421,423],{"className":420},[375],[377,422],{"disabled":379,"type":380}," Alerts reach a paging tool, and we have tested that route.",[54,425,427,429],{"className":426},[375],[377,428],{"disabled":379,"type":380}," An external synthetic check runs against the public hostname and against the origin.",[54,431,433,435],{"className":432},[375],[377,434],{"disabled":379,"type":380}," Log storage has been reviewed for sensitive data.",[54,437,439,441],{"className":438},[375],[377,440],{"disabled":379,"type":380}," The runbook says where to look first for each alert.",[14,443,445],{"id":444},"rehearse-it-once","Rehearse it once",[10,447,448],{},"The cheapest test is a drill. Pick a quiet afternoon. In a staging zone, or carefully in production, break something small: point a health check at a bad port, deploy a rule that blocks a test path, return 500 from a canary route. Then time three things: how long until an alert fires, how long until a person acknowledges it, and how long until that person can say which component is at fault.",[10,450,451],{},"Then replay your last real incident. Take its timeline, find the first moment the data showed a problem, and ask what alert would have fired then. The gap between that moment and the moment you actually found out is the number this work is meant to shrink.",[14,453,455],{"id":454},"if-your-main-origin-started-failing-right-now-who-would-find-out-first-your-team-or-a-customer","If your main origin started failing right now, who would find out first: your team or a customer?",[10,457,458],{},"If you are not sure, that is the gap worth closing, and it is cheaper to close before the next incident than after it. Trivo implements Cloudflare logging, analytics and alerting for teams with small on-call rotations, sized to what people can act on. Bring your last incident timeline and we will show you where an alert would have fired.",{"title":460,"searchDepth":461,"depth":461,"links":462},"",2,[463,464,465,466,467,468,469,470,471,472,473],{"id":16,"depth":461,"text":17},{"id":45,"depth":461,"text":46},{"id":83,"depth":461,"text":84},{"id":122,"depth":461,"text":123},{"id":267,"depth":461,"text":268},{"id":283,"depth":461,"text":284},{"id":332,"depth":461,"text":333},{"id":353,"depth":461,"text":354},{"id":363,"depth":461,"text":364},{"id":444,"depth":461,"text":445},{"id":454,"depth":461,"text":455},"Cloudflare","2026-10-12","Cloudflare records plenty by default. Whether a person hears about a problem in time depends on choices made in a quiet week, not mid-outage.","md",{},"\u002Finsights\u002Fcloudflare-observability",9,[482,483,484],"cloudflare-waf-and-ddos","cloudflare-performance-tuning","cloudflare-zero-trust-and-integrity","operational-efficiency",[487,488],"cloudflare","modernization",{"title":5,"description":476},"insights\u002Fcloudflare-observability","y5VC7z5a7R0RLr5nLLj_Gn9dWplnTGpyl_KJMpWQFMA",[493,500,502,507,512,517,525,530,535,540,546,553,558,564,570,576,582,587,592,597],{"path":494,"title":495,"description":496,"category":497,"readingTime":480,"relatedServices":498,"date":475},"\u002Finsights\u002Fbuild-vs-buy","The License Fee Is the Small Number: A Working Guide to Build or Buy","Buying software is usually right, until the product sits on top of how you make money. How to sort capabilities, price the hidden costs and decide.","Strategy",[499,488],"custom-software",{"path":479,"title":5,"description":476,"category":474,"readingTime":480,"relatedServices":501,"date":475},[487,488],{"path":503,"title":504,"description":505,"category":474,"readingTime":480,"relatedServices":506,"date":475},"\u002Finsights\u002Fcloudflare-performance-tuning","After the Static Assets: Where Cloudflare Performance Is Actually Won","Default caching handles images, CSS and JavaScript. The larger gains sit in HTML, API responses, cache keys and origin trips that nobody tuned.",[487,499],{"path":508,"title":509,"description":510,"category":474,"readingTime":480,"relatedServices":511,"date":475},"\u002Finsights\u002Fcloudflare-waf-and-ddos","Managed Rules Know the Internet. Custom Rules Have to Know Your Application.","Cloudflare's managed WAF and DDoS rules stop generic attacks. Logins, APIs, bots and false positives still need rules written from your own traffic.",[487,499],{"path":513,"title":514,"description":515,"category":474,"readingTime":480,"relatedServices":516,"date":475},"\u002Finsights\u002Fcloudflare-zero-trust-and-integrity","Who Got In Versus What Is Running: Two Integrity Problems One Control Cannot Solve","Zero Trust verifies who reaches a system. Client-side script monitoring verifies what runs in the browser. They fail differently and need separate owners.",[487,488],{"path":518,"title":519,"description":520,"category":521,"readingTime":522,"relatedServices":523,"date":475},"\u002Finsights\u002Fcrm-adoption-and-training","Your CRM Passed Every Test and Nobody Uses It: A Diagnostic for Stalled Adoption","Low CRM adoption is rarely a training gap. How to tell whether the cause is screen friction, missing payback or management habits, and what to fix first.","CRM",8,[524],"crm",{"path":526,"title":527,"description":528,"category":521,"readingTime":522,"relatedServices":529,"date":475},"\u002Finsights\u002Fcrm-implementation-timeline","The Honest Calendar of a CRM Implementation: Five Phases and Where the Weeks Go","Provisioning a CRM takes a day. Making it the place your team sells from takes months. A phase-by-phase calendar, with the parts quotes tend to leave out.",[524,499],{"path":531,"title":532,"description":533,"category":521,"readingTime":480,"relatedServices":534,"date":475},"\u002Finsights\u002Fcrm-migration-checklist","CRM Migration Checklist: The Records Arrive, the Selling Process Gets Left Behind","A CRM migration is a process migration with a data load attached. What a plain export loses, how to choose a cutover, and a checklist for each stage.",[524,488],{"path":536,"title":537,"description":538,"category":521,"readingTime":522,"relatedServices":539,"date":475},"\u002Finsights\u002Fcustom-crm-vs-off-the-shelf","Should You Build Your Own CRM? Run the Build-or-Buy Test on Your Sales Process","Most of a CRM is a commodity you should buy. The question is whether the way you sell fits the platform's model, and what it costs when it does not.",[524,499],{"path":541,"title":542,"description":543,"category":497,"readingTime":544,"relatedServices":545,"date":475},"\u002Finsights\u002Fcustom-software-cost-framework","Estimate Before the Estimate: Sizing a Custom Software Budget on Your Own","You can't know the price before a quote, but you can know what drives it. Six cost drivers, a self-check worksheet and how to read a proposal.",10,[499],{"path":547,"title":548,"description":549,"category":550,"readingTime":480,"relatedServices":551,"date":475},"\u002Finsights\u002Fetl-vs-elt","Transform before or after loading? A practical ETL versus ELT decision for mid-sized teams","ETL or ELT is a question of where transformation runs and who pays for it. A practical way for a mid-sized team to choose, with the costs most plans miss.","Data",[499,552],"ai-automation",{"path":554,"title":555,"description":556,"category":497,"readingTime":544,"relatedServices":557,"date":475},"\u002Finsights\u002Fevaluating-engineering-depth","Ask About the Outage: How to Vet a Software Vendor's Real Engineering Ability","Portfolios and logos look the same from every vendor. The interview questions, artifacts and deal-breakers that show who has really run software in production.",[499,488],{"path":559,"title":560,"description":561,"category":562,"readingTime":544,"relatedServices":563,"date":475},"\u002Finsights\u002Fhipaa-business-associate-agreement","A BAA Is a Contract, Not a Badge: What Your Software Vendor Is Really Signing Up For","What a HIPAA Business Associate Agreement commits a software vendor to, what it leaves unproven, and what to ask and build before PHI reaches the system.","Compliance",[499,552],{"path":565,"title":566,"description":567,"category":562,"readingTime":568,"relatedServices":569,"date":475},"\u002Finsights\u002Fhipaa-technical-safeguards-checklist","Reading 45 CFR 164.312 Like a Design Document: HIPAA Technical Safeguards for Engineers","The five HIPAA technical safeguard standards mapped to concrete engineering decisions: identity, logging, integrity, authentication and encryption.",11,[499,488,487],{"path":571,"title":572,"description":573,"category":574,"readingTime":480,"relatedServices":575,"date":475},"\u002Finsights\u002Flegacy-erp-anticorruption-layer","The ERP stays as it is: building on a decades-old system through an anti-corruption layer","How to build new software on an old ERP without modifying it, using an anti-corruption layer: what goes inside, how to handle writes, when to skip it.","Modernization",[488,499],{"path":577,"title":578,"description":579,"category":580,"readingTime":544,"relatedServices":581,"date":475},"\u002Finsights\u002Fllm-in-production-confidence-thresholds","An LLM that proposes and a system that decides: thresholds, review and audit for production AI","Running an LLM in production without giving it autonomy: measured confidence, thresholds set by business cost, human review that works, an audit trail.","AI",[552,499],{"path":583,"title":584,"description":585,"category":497,"readingTime":480,"relatedServices":586,"date":475},"\u002Finsights\u002Fnearshore-offshore-onshore-cost","Cheap Hours, Expensive Projects: Pricing US, Nearshore and Offshore Teams Honestly","The hourly rate tells you little about what a project will cost. How overlap, rework, turnover and compliance change the math for each delivery model.",[499],{"path":588,"title":589,"description":590,"category":580,"readingTime":480,"relatedServices":591,"date":475},"\u002Finsights\u002Frpa-vs-api-integration","Bots on the screen or calls to the API: where RPA earns its place and where it becomes debt","RPA and API integration solve the same problem at different layers. How to choose, what screen automation really costs, and how to run it safely if you must.",[552,499],{"path":593,"title":594,"description":595,"category":574,"readingTime":480,"relatedServices":596,"date":475},"\u002Finsights\u002Fstrangler-fig-modernization","Replace the legacy system in slices: a working guide to the strangler fig pattern","How to retire a legacy system piece by piece while the business keeps running: the facade, the first slice, parallel runs, and when the pattern fails.",[488,499],{"path":598,"title":599,"description":600,"category":497,"readingTime":544,"relatedServices":601,"date":475},"\u002Finsights\u002Ftwo-week-discovery-deliverables","Paying for a Plan, Not a Pitch: What Two Weeks of Discovery Owes You","A paid discovery should leave you with documents another team could build from. The five deliverables, the work behind them and the limits to expect.",[499,488],1792618973201]