Case study / Infrastructure / Portfolio project
Ops Triage turns sample operational alerts into prioritized incident briefs, keeping the evidence and suggested checks together.
01 / The problem
A service can report the same failure several times as it gets worse. Operators need the highest observed severity, the original evidence, and a defined incident window, rather than a list of disconnected notifications.
This small local tool groups matching service and alert fingerprints into fixed windows, preserves unique messages, and suggests checks by incident category.
02 / Sample result
The included fixture covers capacity, connectivity, access, and a completed backup. These counts come from the sample run; they describe the fixture, rather than a production performance result.
3 alerts · capacity
2 alerts · connectivity
1 alerts · access
2 alerts · general
03 / Design decisions
Grouping is anchored to the first alert, preventing a continuous stream from stretching one incident indefinitely.
Critical, error, warning, and informational severities map to P1–P4. Each brief keeps its highest observed severity.
Counts include repeated events. Distinct messages and first/last timestamps remain in the brief.
Suggested checks guide investigation. The tool makes no connections to infrastructure and runs no remediation commands.
04 / Run it yourself
python triage.py fixtures/alerts.json
python -m unittest -vSeven tests cover severity escalation, grouping windows, service isolation, deterministic output, malformed data, timezone handling, and empty input. The project runs on Python 3.10 or later.
It is a portfolio demonstration, with rule-based categorization and sample data. Production work would add source adapters, service ownership, persistence, redaction, and site-specific runbooks.