Observability & alerts
What is logged, what alarms, and where to look first.
Logging
Structured JSON logging throughout, per request and per domain, so a log line can be filtered by the domain that produced it rather than grepped for.
Paths carrying tokens — the paper-capture handoff in particular — are redacted before logging. A log line should never be a credential.
Alarms
- Application and load balancer health, with alarms routed to a notification topic.
- Database capacity and connection saturation.
- Security findings from GuardDuty.
- API activity auditing through CloudTrail.
Where to look first
- 1Is it one user or everyone?
One user, intermittently, is usually rate limiting. Everyone is a platform problem.
- 2Is it one domain or all of them?
Domain-scoped logs answer this quickly.
- 3Is it the API or a job?
A stalled course is a worker question; a failing screen is an API question.
- 4Check the database first among infrastructure causes
It is the component under most pressure at scale.
Known scale behaviour
The platform has been load-tested at a thousand concurrent users in a dedicated environment with external vendors stubbed. The findings from that work informed the current autoscaling and database floor settings.