DrP: Meta's Efficient Investigations Platform at Scale

Investigations are a significant step in the operational workflows for large scale systems across multiple domains such as services, data, AI/ML, mobile. Investigation processes followed by on-call engineers are often manual or rely on ad-hoc scripts. This leads to inefficient investigations resulting in increased time to mitigate and isolate failures/SLO violations. It also contributes to on-call toil and poor productivity leading to multiple hours/days spent in triaging/debugging incidents. In this paper, we present DrP, an end-to-end framework and system to automate investigations that reduces the mean time to resolve incidents (MTTR) and reduces on-call toil. DrP consists of an expressive and flexible SDK to author investigation playbooks in code (called analyzers), a scalable backend system to execute these automated playbooks, plug-ins to integrate playbooks into mainstream workflows such as alerts and incident management tools, and a post-processing system to take actions on investigations including mitigation steps. We have implemented and deployed DrP at large scale at Meta covering 300+ teams, 2000+ analyzers, across a large set of use cases across domains such as services, core infrastructure, AI/ML, hardware, mobile. DrP has been running in production for the past 5 years and executes 50K automated analyses per day. Overall, our results and experience show that DrP has been able to reduce average MTTR by 20 percent at large scale (with over 80 percent for some teams) and has significantly improved on-call productivity.