DrP: Meta's Efficient Investigations Platform at Scale

TL;DR

DrP is a scalable, automated investigation platform at Meta that significantly reduces incident resolution time and on-call workload by automating complex troubleshooting workflows across diverse domains.

Contribution

The paper introduces DrP, a comprehensive framework with an SDK, backend, and integrations, enabling automated investigations at scale for large organizations.

Findings

Reduced average MTTR by 20% across teams

Deployed at Meta for 5 years, executing 50K analyses daily

Improved on-call productivity significantly

Abstract

Investigations are a significant step in the operational workflows for large scale systems across multiple domains such as services, data, AI/ML, mobile. Investigation processes followed by on-call engineers are often manual or rely on ad-hoc scripts. This leads to inefficient investigations resulting in increased time to mitigate and isolate failures/SLO violations. It also contributes to on-call toil and poor productivity leading to multiple hours/days spent in triaging/debugging incidents. In this paper, we present DrP, an end-to-end framework and system to automate investigations that reduces the mean time to resolve incidents (MTTR) and reduces on-call toil. DrP consists of an expressive and flexible SDK to author investigation playbooks in code (called analyzers), a scalable backend system to execute these automated playbooks, plug-ins to integrate playbooks into mainstream workflows such as alerts and incident management tools, and a post-processing system to take actions on investigations including mitigation steps. We have implemented and deployed DrP at large scale at Meta covering 300+ teams, 2000+ analyzers, across a large set of use cases across domains such as services, core infrastructure, AI/ML, hardware, mobile. DrP has been running in production for the past 5 years and executes 50K automated analyses per day. Overall, our results and experience show that DrP has been able to reduce average MTTR by 20 percent at large scale (with over 80 percent for some teams) and has significantly improved on-call productivity.