[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"article:hatena-mackerel-alert-design":3},{"meta":4,"markdown":66},{"type":5,"articleId":6,"slug":7,"title":8,"titleEn":9,"category":10,"summary":11,"publishedAt":12,"image":13,"vocabulary":14},"article","tech-hatena-mackerel","hatena-mackerel-alert-design","MackerelのAlert設計思想","The Alert Design Philosophy of Mackerel","tech","Hatena's Mackerel monitoring SaaS embodies a clear alert design philosophy: alert on symptoms, not causes; group hosts by service and role; integrate with on-call rotations via PagerDuty\u002FOpsgenie; manage monitors as code with the Terraform provider; and choose push vs pull metric collection deliberately.\n","2026-04-27T00:00:00Z","https:\u002F\u002Fimages.yamiyomi.com\u002Ftech-hatena-mackerel.png",[15,20,24,29,34,38,42,46,50,54,58,62],{"word":16,"reading":17,"meaning":18,"level":19},"思想","しそう","philosophy","N1",{"word":21,"reading":22,"meaning":23,"level":19},"症状","しょうじょう","symptom",{"word":25,"reading":26,"meaning":27,"level":28},"原因","げんいん","cause","N3",{"word":30,"reading":31,"meaning":32,"level":33},"通知","つうち","notification","N2",{"word":35,"reading":36,"meaning":37,"level":33},"当番","とうばん","on-call duty",{"word":39,"reading":40,"meaning":41,"level":19},"輪番","りんばん","rotation",{"word":43,"reading":44,"meaning":45,"level":28},"設定","せってい","configuration",{"word":47,"reading":48,"meaning":49,"level":33},"収集","しゅうしゅう","collection",{"word":51,"reading":52,"meaning":53,"level":19},"抑止","よくし","suppression",{"word":55,"reading":56,"meaning":57,"level":33},"重大","じゅうだい","serious",{"word":59,"reading":60,"meaning":61,"level":28},"対応","たいおう","response",{"word":63,"reading":64,"meaning":65,"level":33},"視点","してん","viewpoint","\n::para\n[株式会社]{かぶしきがいしゃ:corporation:N1}はてなが[提供]{ていきょう:provides:N1}するSaaS[型]{がた:type:N2}[監視]{かんし:monitoring:N1}サービス「Mackerel」は、2014[年]{ねん:year:N5}のリリース[以来]{いらい:since:N4}、[多く]{おおく:many:N4}の[国内]{こくない:domestic:N3}[企業]{きぎょう:companies:N1}に[利用]{りよう:used:N3}されてきました。Mackerelの[最大]{さいだい:greatest:N3}の[特徴]{とくちょう:feature:N1}は、[単なる]{たんなる:mere:N3}メトリクス[収集]{しゅうしゅう:collection:N3}ツールではなく、「どのようにアラートを[設計]{せっけい:design:N2}すべきか」という[思想]{しそう:philosophy:N3}を[製品]{せいひん:product:N1}に[込めて]{こめて:imbued:N3}いる[点]{てん:point:N3}にあります。\n\n#en\n\"Mackerel,\" the SaaS-type monitoring service offered by Hatena, has been used by many domestic companies since its release in 2014. Mackerel's greatest feature is that it is not a mere metrics collection tool — it imbues into the product a philosophy of \"how alerts should be designed.\"\n::\n\n::heading\n[症状]{しょうじょう:symptom:N1}[駆動]{くどう:driven:N1}アラート\n\n#en\nSymptom-Driven Alerts\n::\n\n::para\nMackerelが[推奨]{すいしょう:recommends:N1}するのは、「[原因]{げんいん:cause:N3}」ではなく「[症状]{しょうじょう:symptom:N1}」に[基づく]{もとづく:based on:N1}アラート[設計]{せっけい:design:N2}です。たとえば「CPUが[高い]{たかい:high:N5}」というアラートは[原因]{げんいん:cause:N3}[側]{がわ:side:N3}の[指標]{しひょう:metric:N1}で、ユーザーが[実際]{じっさい:actually:N3}に[影響]{えいきょう:impact:N1}を[受けて]{うけて:receiving:N3}いるかは[分かり]{わかり:understand:N5}ません。[一方]{いっぽう:on the other hand:N4}、「APIの[応答]{おうとう:response:N1}[時間]{じかん:time:N5}が500ミリ[秒]{びょう:milliseconds:N2}を[超えた]{こえた:exceeded:N2}」は[症状]{しょうじょう:symptom:N1}[側]{がわ:side:N3}の[指標]{しひょう:metric:N1}で、ユーザー[体験]{たいけん:experience:N4}に[直接]{ちょくせつ:directly:N2}[結び付き]{むすびつき:tied to:N1}ます。\n\n#en\nWhat Mackerel recommends is alert design based not on \"cause\" but on \"symptom.\" For example, \"CPU is high\" is a cause-side metric, and you cannot tell whether users are actually being impacted. On the other hand, \"API response time exceeded 500 milliseconds\" is a symptom-side metric, directly tied to the user experience.\n::\n\n::callout\n[要点]{ようてん:key point:N3}：[原因]{げんいん:cause:N3}でアラートを[組む]{くむ:set up:N3}と[誤]{ご:false:N3}[検知]{けんち:detection:N1}が[多発]{たはつ:frequent occurrence:N4}し、[当番]{とうばん:on-call:N3}[担当者]{たんとうしゃ:engineer:N2}の[負担]{ふたん:burden:N2}が[過大]{かだい:excessive:N3}になります。\n\n#en\nKey point: Setting up alerts on causes leads to frequent false detections and overburdens on-call engineers.\n::\n\n::heading\nホスト[単位]{たんい:unit:N3}とサービス[単位]{たんい:unit:N3}のグルーピング\n\n#en\nHost-Based vs Service-Based Grouping\n::\n\n::para\nMackerelは[全]{ぜん:all:N3}メトリクスを「ホスト」と「[役割]{やくわり:role:N3}（ロール）」、そして「サービス」の[三層]{さんそう:three layers:N2}で[管理]{かんり:manages:N2}します。[個別]{こべつ:individual:N2}ホストの[障害]{しょうがい:incident:N1}は[許容]{きょよう:tolerated:N3}されるが、[同じ]{おなじ:same:N4}[役割]{やくわり:role:N3}を[持つ]{もつ:has:N4}ホスト[群]{ぐん:group:N2}の[半数]{はんすう:half:N3}が[落ちる]{おちる:goes down:N3}と[重大]{じゅうだい:serious:N4}という、[組織]{そしき:organizational:N1}の[視点]{してん:viewpoint:N1}に[沿った]{そった:aligned with:N1}アラート[条件]{じょうけん:conditions:N1}が[設定]{せってい:configured:N2}できます。これによりオートスケールで[頻繁]{ひんぱん:frequently:N1}にホストが[入れ替わる]{いれかわる:swap in and out:N2}[環境]{かんきょう:environments:N1}でも[安定]{あんてい:stable:N3}した[監視]{かんし:monitoring:N1}が[可能]{かのう:possible:N3}になります。\n\n#en\nMackerel manages all metrics across three layers: \"host,\" \"role,\" and \"service.\" It allows alert conditions aligned with the organizational viewpoint — for example, \"individual host failures are tolerated, but if half of the host group sharing the same role goes down, it is serious.\" This enables stable monitoring even in environments where hosts frequently swap in and out via autoscaling.\n::\n\n::heading\nオンコールローテーションとの[統合]{とうごう:integration:N1}\n\n#en\nIntegration with On-Call Rotation\n::\n\n::para\nMackerelは[単独]{たんどく:alone:N1}でアラート[配信]{はいしん:delivery:N3}を[完結]{かんけつ:complete:N1}させるのではなく、PagerDutyやOpsgenieといった[専門]{せんもん:specialized:N2}のオンコール[管理]{かんり:management:N2}サービスと[連携]{れんけい:integrate:N1}する[設計]{せっけい:design:N2}を[採用]{さいよう:adopts:N2}しています。[当番]{とうばん:on-call duty:N3}の[輪番]{りんばん:rotation:N2}、エスカレーション、[通知]{つうち:notification:N4}[抑止]{よくし:suppression:N1}（[業務]{ぎょうむ:business:N3}[時間]{じかん:hours:N5}[外]{がい:outside:N5}の[扱い]{あつかい:handling:N1}など）はそれら[専用]{せんよう:dedicated:N2}サービスに[任せる]{まかせる:entrust:N3}という[役割]{やくわり:role:N3}[分担]{ぶんたん:division:N2}です。\n\n#en\nRather than completing alert delivery alone, Mackerel adopts a design that integrates with specialized on-call management services such as PagerDuty and Opsgenie. The role division is to entrust on-call rotation, escalation, and notification suppression (such as handling outside business hours) to those dedicated services.\n::\n\n::heading\nMonitor as CodeとTerraformプロバイダー\n\n#en\nMonitor as Code and the Terraform Provider\n::\n\n::para\n[監視]{かんし:monitoring:N1}[設定]{せってい:configuration:N2}をUIから[手作業]{てさぎょう:manually:N4}で[行う]{おこなう:do:N5}と、[誰]{だれ:who:N3}がいつ[何]{なに:what:N5}を[変更]{へんこう:changed:N3}したかが[分から]{わから:unclear:N5}なくなりがちです。Mackerelは[公式]{こうしき:official:N3}のTerraformプロバイダーを[提供]{ていきょう:provides:N1}しており、[全]{ぜん:all:N3}[監視]{かんし:monitoring:N1}[設定]{せってい:configurations:N2}をコードとしてGitで[管理]{かんり:manage:N2}できます。プルリクエストレビューを[経て]{へて:through:N3}[本番]{ほんばん:production:N3}に[反映]{はんえい:reflected:N3}される[仕組み]{しくみ:mechanism:N3}は、[一般的]{いっぱんてき:general:N2}なインフラ[構成]{こうせい:configuration:N3}[管理]{かんり:management:N2}と[変わら]{かわら:no different:N3}ない[体験]{たいけん:experience:N4}です。\n\n#en\nWhen monitoring configurations are done manually from the UI, it tends to become unclear who changed what and when. Mackerel provides an official Terraform provider, allowing all monitoring configurations to be managed as code in Git. The mechanism by which changes go through pull request review before being reflected in production provides an experience no different from general infrastructure configuration management.\n::\n\n::callout\n[補足]{ほそく:supplementary note:N2}：Monitor as Codeを[導入]{どうにゅう:adopting:N2}する[際]{さい:when:N3}は、[既存]{きそん:existing:N1}の[監視]{かんし:monitoring:N1}[設定]{せってい:configurations:N2}をimport[コマンド]{こまんど:command}でコード[化]{か:into:N3}する[初期]{しょき:initial:N3}[作業]{さぎょう:work:N4}が[必要]{ひつよう:necessary:N3}になります。\n\n#en\nSupplementary note: When adopting Monitor as Code, initial work to convert existing monitoring configurations into code via the import command is necessary.\n::\n\n::heading\nプッシュ[型]{がた:type:N2}とプル[型]{がた:type:N2}の[使い分け]{つかいわけ:choosing between:N4}\n\n#en\nChoosing Between Push and Pull Collection\n::\n\n::para\n[従来]{じゅうらい:conventional:N1}の[監視]{かんし:monitoring:N1}ツールはプル[型]{がた:type:N2}（[監視]{かんし:monitoring:N1}サーバーが[対象]{たいしょう:targets:N2}にメトリクスを[取りに]{とりに:fetch:N3}[行く]{いく:go:N5}）が[主流]{しゅりゅう:mainstream:N3}でしたが、Mackerelは[基本]{きほん:fundamentally:N1}プッシュ[型]{がた:type:N2}（[各]{かく:each:N2}ホストのエージェントがメトリクスを[送り付ける]{おくりつける:send up:N3}）を[採用]{さいよう:adopts:N2}しています。プッシュ[型]{がた:type:N2}はファイアウォール[越し]{ごし:across:N3}でも[動作]{どうさ:works:N4}しやすく、オートスケール[環境]{かんきょう:environments:N1}との[相性]{あいしょう:compatibility:N3}が[良い]{よい:good:N3}です。[一方]{いっぽう:on the other hand:N4}、[特定]{とくてい:specific:N3}のユースケースではPrometheus[互換]{ごかん:compatible:N2}のプル[型]{がた:type:N2}[収集]{しゅうしゅう:collection:N3}も[サポート]{さぽーと:supported}されており、[適材]{てきざい:right material:N2}[適所]{てきしょ:right place:N3}で[選択]{せんたく:select:N1}できます。\n\n#en\nConventional monitoring tools were mainstream pull-type (the monitoring server fetches metrics from targets), but Mackerel fundamentally adopts push-type (an agent on each host sends metrics up). Push-type works easily across firewalls and has good compatibility with autoscaling environments. On the other hand, for specific use cases, Prometheus-compatible pull-type collection is also supported, allowing users to select the right tool for the right place.\n::\n\n::heading\nおわりに\n\n#en\nConclusion\n::\n\n::para\nMackerelの[設計]{せっけい:design:N2}[思想]{しそう:philosophy:N3}は、「[人]{ひと:human:N5}が[反応]{はんのう:respond:N1}できないアラートは[作らない]{つくらない:do not create:N4}」という[一点]{いってん:single point:N3}に[集約]{しゅうやく:converges:N3}されます。[症状]{しょうじょう:symptom:N1}[駆動]{くどう:driven:N1}、[役割]{やくわり:role:N3}[単位]{たんい:unit:N3}のグルーピング、オンコールサービスとの[連携]{れんけい:integration:N1}、Monitor as Code — これらは[全て]{すべて:all:N3}[当番]{とうばん:on-call:N3}[担当者]{たんとうしゃ:engineer:N2}の[負担]{ふたん:burden:N2}を[減らし]{へらし:reduce:N2}、[本当に]{ほんとうに:truly:N3}[重要]{じゅうよう:important:N3}な[障害]{しょうがい:incidents:N1}に[集中]{しゅうちゅう:focus:N4}できる[環境]{かんきょう:environment:N1}を[作る]{つくる:create:N4}ための[手段]{しゅだん:means:N3}です。\n\n#en\nMackerel's design philosophy converges on a single point: \"do not create alerts to which humans cannot respond.\" Symptom-driven, role-based grouping, integration with on-call services, Monitor as Code — these are all means to reduce the burden on on-call engineers and create an environment in which they can focus on truly important incidents.\n::\n"]