Series / Databases
A 2026 field guide to collecting database evidence deterministically, detecting anomalies statistically, using LLMs to develop testable root-cause hypotheses, and keeping production changes under human control.
DBAs, SREs, platform engineers, and cloud architects responsible for diagnosing database and cache performance incidents across self-managed and managed services.
Production familiarity with at least one database engine and basic knowledge of metrics, waits, query plans, logs, and cloud infrastructure.
The evidence model, anomaly boundary, reasoning contract, and safety model shared by every engine-specific investigation.
Dashboards expose database symptoms one layer at a time. This architecture turns time-bounded telemetry into ranked, testable root-cause hypotheses without giving an LLM production control.
A practical evidence contract for collecting, normalizing, redacting, storing, and presenting time-bounded database telemetry to an LLM without sending an uncontrolled production dump.
A deterministic anomaly-detection layer that turns normalized database telemetry into attributable, operationally meaningful evidence before LLM correlation begins.
A security and change-control architecture for turning LLM-generated database performance hypotheses into auditable proposals without giving the model production authority.
Host and engine triage, SQL and InnoDB diagnosis, Aurora-specific behavior, and production guardrails.
A layered MySQL 8.4 triage method for distinguishing EC2 compute, memory, EBS, connection, lock, and engine-wait failures before investigating individual SQL statements.
A MySQL 8.4 investigation method for using statement-digest deltas, latency distributions, execution plans, and LLM correlation to prove which workload changed.
An Aurora-native investigation method for correlating per-instance database load, distributed storage, reader lag, endpoint behavior, and failover readiness with LLM assistance.
A MySQL and Aurora security architecture for collecting useful performance evidence without exposing raw SQL, granting production authority, or losing auditability.
Host and wait-event triage, plan analysis, Aurora-specific behavior, and production guardrails.
A PostgreSQL-on-EC2 incident workflow for correlating backend state, wait events, locks, cumulative I/O, Linux pressure, and EBS limits before investigating SQL plans.
A safe PostgreSQL workflow for ranking query regressions from interval deltas, capturing the right execution plan, and using an LLM without mistaking correlation for proof.
An Aurora PostgreSQL incident workflow for separating writer pressure, shared-storage activity, local temporary I/O, WAL retention, replica lag, and application recovery after failover.
A PostgreSQL and Aurora control plane for collecting performance evidence without leaking SQL, overloading production, confusing audit sources, or granting an LLM change authority.
DB time, SQL regression, concurrency and platform behavior, licensing boundaries, and safe diagnostic access.
An Oracle incident workflow for reconciling application symptoms, DB time, average active sessions, CPU, non-idle waits, host pressure, and licensed diagnostic evidence.
An Oracle investigation workflow for proving SQL regressions with child-cursor history, normalized runtime evidence, actual row counts, bind behavior, and reversible plan control.
An Oracle incident workflow for proving whether blocking, commit processing, RAC block transfer, storage, or cloud infrastructure—not SQL efficiency—caused the slowdown.
An Oracle control-plane design for licensed evidence collection, least-privilege diagnostics, deterministic redaction, end-to-end audit lineage, and human-approved production changes.
Self-managed MongoDB cache and workload triage, query shapes, sharding, replication, and diagnostic-data controls.
A self-managed MongoDB incident workflow for correlating WiredTiger cache, host pressure, connections, workload, replication progress, and topology evidence without mistaking symptoms for causes.
A self-managed MongoDB workflow for ranking expensive query shapes, interpreting explain evidence, diagnosing aggregation fan-out, and validating reversible index changes.
A self-managed MongoDB workflow for distinguishing routing fan-out, uneven ownership, range-migration overhead, cleanup debt, and replica-set pressure.
A self-managed MongoDB control plane for minimizing diagnostic data, separating access, auditing decisions and actions, and preventing LLM-driven production changes.
Valkey on EC2, workload and data-structure diagnosis, ElastiCache-specific behavior, and safe cache operations.
A production triage workflow for diagnosing Valkey on EC2: separating engine event loop delays from host memory fragmentation, CPU credit exhaustion, eviction storms, and network PPS limits.
A production engineering guide to identifying slow commands, hot keys, big collections, unbounded pipelines, and blocking Lua scripts in Valkey without impacting live traffic.
A production triage and performance engineering guide for Amazon ElastiCache for Valkey: diagnosing shard skew, replication lag, cluster-mode failover, and managed-service boundaries.
An operational security guide for LLM-assisted Valkey and ElastiCache diagnostics: protecting key privacy, configuring least-privilege ACLs, handling audit trails, and enforcing change guardrails.
Cluster resource behavior and search profiling without overstating what incomplete profile evidence proves.
A cluster-level diagnostic guide for Elasticsearch: isolating JVM garbage collection stalls, thread pool rejections, over-sharding bloat, disk watermarks, and circuit breakers.
A deep dive into diagnosing slow Elasticsearch queries: using the Search Profile API to separate query, fetch, and aggregation phases from thread queue delays and network transit.
Recall-latency tradeoffs, vector-search diagnosis, and end-to-end RAG performance engineering.
A systems engineering analysis of vector search performance: navigating the fundamental tradeoff between Recall@K, query latency, index memory footprint, quantization, and filtered search.
A production triage guide for multi-stage vector search: isolating query embedding latency, HNSW graph degradation, hybrid BM25 fusion skew, and cross-encoder reranking bottlenecks.
An end-to-end performance engineering guide for production RAG: optimizing query embedding, hybrid retrieval, reranking, prompt caching, time-to-first-token, and cost per request.