Rank the alert before you open the dashboard

When a pager fires at 02:10, the temptation is to open every panel that looks related. In our Lumpinee classroom we ask learners to write the alert title, the service it names, and three possible causes before any screen is touched.

That ranking pass is observability signal analysis in miniature. A metric spike without a matching log line sits lower than a trace that shows a timeout on a named dependency. The exercise is not about prettier graphs. It is about deciding which signal deserves the next ten minutes of attention.

We use printed excerpts from Thai retail and banking stacks because the vocabulary is familiar: payment gateways, SMS callbacks, and warehouse APIs. Learners mark each excerpt as primary, supporting, or discarded. Discarded does not mean deleted from the collector. It means it will not drive the first hypothesis.

If you practise this ranking for two weeks of on-call, your notes start to mention signal names instead of “looked at the dashboard.” That change is what hiring managers in Bangkok operations groups actually read.