Service Error: Identify and Classify Root-Cause Patterns in Service Error Logs

Question

## Problem

You are given a list of service error events, each with a `service`, `error_code`, and `timestamp`. Identify all `(service, error_code)` pairs that appear more than `threshold` times within any rolling 60-second window.

Return results as a list of `(service, error_code, window_start, count)` tuples, sorted by `window_start`.

```python
from typing import List, Tuple

def find_error_bursts(
    events: List[Tuple[str, str, int]],
    threshold: int
) -> List[Tuple[str, str, int, int]]:
    # events: [(service, error_code, timestamp_sec), ...] sorted by timestamp
    # return: [(service, error_code, window_start, count), ...]
    pass
```

**Example:**
```
events = [
  ("auth", "500", 0), ("auth", "500", 10), ("auth", "500", 50),
  ("auth", "500", 70), ("db", "timeout", 5)
]
threshold = 2

Window [0,60): auth/500 appears 3 times > 2 -> include
Output: [("auth", "500", 0, 3)]
```

## Follow-ups

1. How do you adapt this to a live stream where events arrive with up to 30 seconds of out-of-order delay?
2. What alerting de-duplication strategy would you apply to avoid flooding on-call with repeated alerts?
3. How would you store and query this data efficiently in a time-series database?
4. How would you distinguish transient bursts from sustained elevated error rates?

Service Error: Identify and Classify Root-Cause Patterns in Service Error Logs

Question Details

Full Details

Topics

More from Snowflake