systemd

The mitigation playbook died on the ninth server: journald.conf.d had never existed. One file state=directory task closes that assumption for good.

TL;DR: An Ansible playbook copying a journald cap into /etc/systemd/journald.conf.d failed on one server because that directory never existed there; the other eight just happened to have it. The fix is one directory task with state=directory placed before the copy. Lesson: every playbook assumption, like a parent directory existing, should be an explicit idempotent task.

A last value without its age is a lie. Adding staleness badges (fresh/aging/dead), window-following aggregates, and portable systemd timestamps.

TL;DR: A dashboard showed 3% CPU while the service had been dead for seven hours, because the last sample was rendered as if fresh. The fix classifies data as fresh, aging, or dead based on age versus poll interval. Lesson: a value without its age is a lie.