Event correlation
Combining logs from multiple services, network timestamps, request identifiers and configuration changes.
TROUBLESHOOTING / RCA
From symptom to cause — without guessing across layers.
I investigate problems that occur intermittently or depend on timing, routes, customers or several systems. Evidence from the network, application and host is assembled into one timeline.
- Evidence
- Logs, packet captures, metrics
- Method
- Successful sample vs failure
- Deliverable
- RCA, fix, prevention
APPROACH
The hardest incidents occur at system boundaries.
A symptom visible in an application can originate in DNS, the network, a resource limit, an external API, a database or client behaviour. Analysing only one layer can then lead to false conclusions.
I build a timeline and compare the failed case with a successful one. I look for the first point where their behaviour diverges, rather than focusing only on the final error message.
Once the cause is identified, I assess whether the fix removes the source of the problem or simply masks the symptom. The result includes reproduction steps, evidence, the change and proposed monitoring.
AREAS OF EXPERTISE
Areas I combine in one project.
The scope follows your goal and the current state of the environment. We can start with a single issue or a complete project.
Traffic analysis
tcpdump, Wireshark, HTTP, TLS, SIP, RTP, retransmissions, latency and connection behaviour.
Resources and dependencies
CPU, memory, storage, processes, limits, timeouts and connections to databases and external services.
RCA and safeguards
Documentation of the cause, impact, fix, regression test and monitoring that detects a recurrence.
WHAT YOU RECEIVE
What you receive beyond the configuration.
A deployment should be verifiable, maintainable and safe to develop further.
- 01
An incident timeline and a list of systems and evidence used in the analysis.
- 02
A comparison of successful and failed samples, including the first confirmed point of divergence.
- 03
An explanation of the root cause, contributing factors and user impact.
- 04
A fix or remediation plan with a test confirming the outcome.
- 05
Preventive actions: monitoring, alerts, logging or a procedural change.
HOW I WORK
From context to controlled deployment.
- 01
Incident scope
I establish the time, users, systems, frequency and conditions of occurrence.
- 02
Evidence preservation
I collect logs, packet captures and system state before rotation or a restart removes the evidence.
- 03
Hypothesis and test
I form hypotheses based on evidence and eliminate them through controlled tests.
- 04
RCA
I document the cause, fix, regression risk and ways to detect the issue earlier.
WHEN IT HELPS
This service makes sense when…
You do not need a finished specification. A specific problem, risk or desired outcome is enough.
- A problem occurs only a few times a day or affects selected customers.
- Application, network and infrastructure teams see different parts of the same event.
- A restart helps, but the cause and time of recurrence are unknown.
- Successful and failed samples look similar at the basic call-flow level.
- You need a technical explanation for a customer or a post-incident report.
tcpdump
Wireshark
Linux
journald
Nginx
Docker logs
SIP
HTTP
SQL
Python
RELATED WORK
See how these skills come together in a working project.
CYBERSECURITY / AI / EVIDENCE
AISeeRisk
A security audit platform combining an authorised scope, reliable evidence, risk prioritisation and controlled remediation with subsequent verification.
Read the case study →
MONITORING / OBSERVABILITY
UPnator
A monitoring and reliability platform for websites, APIs, servers, databases and telephony, with alerts, status pages, incident history and SLO reports.
Read the case study →
AI / VOIP / COMMUNICATION PLATFORM
Callchestra
A business communication orchestration platform combining AI agents, PBX, routing, workflows, call analytics and integrations in one controlled environment.
Read the case study →
VOIP / COMMUNICATION PLATFORM
RelayPBX
A platform for building and operating business telephony, combining visual configuration, routing, tenants, SIP diagnostics and different deployment models.
Read the case study →
HEALTHCARE / BOOKING
Psycholog Spektrum
A psychology practice website combining a calm presentation of its services, appointment booking, contact forms and tools for everyday administration.
Read the case study →
COMMUNITY / AUTOMOTIVE
Pokaż Brykę
A community for car projects with vehicle profiles, modification histories, rankings, categories, a Spotted module and engagement features.
Read the case study →
EVENTS / ORGANIZER PLATFORM
Eventnado
A two-sided event platform combining a catalogue and search for attendees with planning, administrative requirements, registration and event operations for organisers.
Read the case study →FAQ
Common questions before we start.
Can you work from logs alone?
Yes, if they contain enough context. For network or protocol issues, a packet capture usually makes analysis much faster and helps confirm the sequence of events.
What is needed to compare successful and failed samples?
The exact time, request identifier or Call-ID, the parties involved and, where possible, the same range of logs and traffic for both cases.
Is a restart an acceptable fix?
It can be an emergency measure, but it is not a root cause analysis. We need to establish which state the restart clears, why it appears and how to detect it earlier.
What does the final report include?
It includes a summary, impact, timeline, evidence, root cause, contributing factors, the implemented fix, test results and preventive actions.
NEXT STEP
Have an incident where every component looks correct in isolation?
Let's build a shared timeline and compare behaviour across layers. The breakthrough usually comes at the first point of divergence, not the last error.