Core Thesis: A growing telemetry archive can reveal an organization’s failure to learn. When familiar incidents still require reconstruction from logs, traces, and metrics, evidence accumulates without improving recognition. The search box conceals the pile and the habits that produce it. Situational awareness requires experience to change the observer: patterns become recognizable, expectations become explicit, and evidence can recede as understanding strengthens. Progress means reconstructing less of the past to understand the present.
There’s a familiar television program where someone enters a home filled with years of accumulated possessions. Boxes clutter the rooms, newspapers cover the tables, and cupboards stand jammed open. Objects that once held value have vanished beneath thousands of others kept because they might be useful someday.
The reaction is immediate: how can anyone live like this?
We also wonder about the person who created this unwelcoming space. Why was so little discarded? Why did every object keep claiming to be useful? Why did the accumulation continue even after it started getting in the way of daily life? Why didn’t the negative effects of keeping everything change how people acted? The state of the house tells us something about the decision-making system that made it. We start to think about things like judgment, what’s important, what we can’t control, what we focus on, what we connect with, and how we can let go.
Now consider a large technology organization. Logs arrive continuously. Traces arrive continuously. Metrics, events, profiles, attributes, and metadata follow them. Petabytes accumulate, and much of this material will never participate in a diagnosis, decision, or intervention. Nobody walks into the operations centre, looks around in horror, and asks: What does this tell us about the organization? We call it an observability platform. We should see it differently.
What does the environment tell us?
Consider an organization as a collective intelligence. This collective intelligence aids in focusing, discerning the most crucial aspects, prioritizing effectively, facilitating learning from actions, ensuring a clear understanding of its significance, and guiding the elimination of unnecessary elements. These cognitive processes and decision-making activities collectively shape the organizational member’s knowledge and perception of the business environment.
The creation of the telemetry store reveals the collective’s characteristics.
The ease of information entry, minimal data loss, a single missing field causing permanent expansion, and repeated experience resulting in more records without improved recognition suggest that the accumulation itself warrants interpretation. It’s like trying to understand the significance of information, but every detail demands attention, every uncertainty compels retention, and every event contributes to the collection, leaving unanswered questions.
The physical hoarder confronts the consequences in every room. The digital organization gets a search box.
The invisible hoard
Physical accumulation generates feedback loops. Rooms become cramped, searching for items takes longer, movement is restricted, and daily routines shift to accommodate possessions. Digital accumulation barely registers at a sensory level. The office remains tidy, and the dashboard remains clean. The interface presents a query editor and a small empty field labeled “Search.” Behind this field, trillions of records may reside.
The volume of telemetry can double while the search field remains the same size.
Digital infrastructure separates accumulation from perception. Physical consequences are stored in clusters, object stores, and billing reports, leaving the environment silent. When these consequences fade, one of the most effective ways to correct behavior also disappears.
An organization can continue accumulating assets without ever needing to physically interact with them.
Why everything stays
Every object that is kept tends to have a purpose. I might need it, or it could become useful in the future.
Telemetry accumulates through a similar process. We may need it during an incident, but we don’t know which attribute will be crucial. The next outage might involve an interaction we’ve never encountered before. Each decision can be perfectly reasonable, and the accumulation emerges from thousands of such reasonable local decisions.
A production incident exposes a missing field, so add it. A difficult investigation would have been easier with richer traces, so collect them. A new service creates another useful dimension, so keep it. Someone remembers the incident where thirty days of history was insufficient, so extend retention.
An organization has strong mechanisms for adding information, and much weaker mechanisms for refusing it.
Without a clear model of the situations the organization needs to recognize, almost any observation can be defended as potentially useful. Uncertainty acquires physical form as telemetry, and because the telemetry itself remains mostly invisible, the accumulation creates little pressure to reconsider the behaviour producing it.
Over time a simple operating principle takes hold: Collect now. Interpret later.
Searching the house
Imagine that somewhere within the house lies an important document. You’re certain it’s there, so you start opening boxes—room by room, container by container, year by year. Modern incident investigations often follow a similar pattern. You open the dashboard, expand the trace, filter by service, search the logs, add another predicate, widen the time range, inspect another deployment, and correlate another event. At 3:33 in the morning, the observability capability transforms into a tired engineer with six browser tabs open, moving between traces, logs, metrics, and dashboards, desperately trying to reconstruct the current state of the system. Sometimes, the system has encountered almost the same situation multiple times before, and the reconstruction process begins anew.
Our search machinery has become incredibly sophisticated. Distributed query engines can now sift through vast amounts of evidence that would have been insurmountable in the past. This capability enables the accumulation of significant data, but it also allows a deeper flaw to remain concealed. When understanding relies on repeatedly searching historical evidence, the observing system has done little to establish its significance during the course of events. In this case, search becomes the mechanism through which humans derive meaning from preserved records.
This is akin to searchable ignorance: the evidence exists somewhere, and the situation is still to be recognized.
Storage is a poor model of memory
A telemetry archive retains observations in the most rudimentary sense, preserving them for future reference.
Human memory operates vastly differently. Our memories shape how we recognize things in the future. What we’ve experienced before changes what catches our eye, what feels familiar, what surprises us, and what we can pick up on quickly. When we experience something again and again, we create connections and anticipate what might happen next. As time goes on, the details might blur, but the patterns stick around, and our memory changes us.
Think about a system that’s seen the same operational pattern a thousand times. A queue starts to get longer, consumer throughput drops, retries go up, and latency increases as it moves downstream. If it still takes an engineer to dig through historical telemetry and piece together those relationships after the thousandth time, the system has a lot of history, but its ability to recognize it hasn’t changed much. The archive keeps growing, and recognition doesn’t really improve. Another incident pops into the database, and the next one still starts with a search box.
Compression is not learning
The industry has mastered making it easier to manage data growth. We’ve seen compression get better, storage costs drop, pipelines run smoother, indexes speed up, and query engines handle bigger datasets. But all these improvements are aimed at keeping the current architecture running longer, even though it’s nearing the end of its useful life.
Compressing ten thousand traces preserves ten thousand traces more efficiently. Learning from ten thousand traces changes how the next trace is interpreted. Learning leaves the observing system altered by experience.
That distinction matters because situational awareness depends on transformation.
The system needs to carry forward significance, expectations, relationships and recognized conditions. Archive size and query speed each leave that capability exactly where it stands.
Learning changes the representation. Compression is one consequence of that change.
A storage conception of memory asks: How much of the past can we preserve? A learning conception asks: What has the past changed in us? That is a radically different architecture.
Successful learning should ideally culminate in a more practical understanding, with less emphasis on historical facts.
Reconstructing What Was
A measurement can become evidence. Evidence can become a sign that something significant is occurring. Signs can alter operational status. Statuses can contribute to the recognition of a situation. A recognized situation creates expectations about what is happening, what may happen next and which actions are available.
One possible progression is: measurement → evidence → sign → status → situation → projection → action
Modern observability remains heavily concentrated near the beginning. It produces measurements, retains evidence, and makes evidence searchable. People then perform much of the remaining transformation, frequently under pressure. The result is an architecture where operational understanding is reconstructed from history again and again.
The system sees continuously, and its capacity to recognize develops slowly.
Evidence should decay as understanding increases
Distributed systems produce interactions nobody predicted, and a field that looked irrelevant may become the clue that explains an unprecedented outage. Raw evidence therefore has some forensic role. Novelty should influence retention. Uncertainty should influence retention. Confidence should influence retention. An unfamiliar pattern can justify preserving extensive supporting evidence. A low-confidence situation can retain the observations from which it emerged. A violation of established expectations can open a richer evidence window. A repeatedly recognized pattern with well-established relationships can allow more supporting detail to recede. Understanding changes what must remain, and a useful principle follows: Evidence should decay as understanding increases.
A system that lacks a deep understanding requires more substantial evidence. As understanding grows, evidence transforms into a structured framework. A stable understanding allows supporting details to diminish. Unexpected behavior can even enhance retention. This approach enables the system to respond to unknowns without making universal preservation a permanent architectural rule. The system can represent: “I don’t understand this yet.” This statement already holds operational significance. Uncertainty itself can become an integral part of the situation.
Look at the machinery we already built
A common engineering concern arises from this. Producing signs, statuses and situations introduces interpretation machinery. That machinery can fail. It can become complex. It has to be inspected and maintained. All true.
Now look at the system already surrounding the telemetry archive: collectors, processors, sampling systems, enrichment pipelines, schema registries, storage tiers, indexes, query planners, trace stores, metric stores, log stores, profile stores, dashboards, alert engines, correlation systems, incident tooling, and AI assistants sitting above the accumulation and trying to summarize what it contains. The operating principle of collect now, interpret later already demands an enormous technical estate. A situational architecture reallocates some of that engineering effort toward establishing operational state while the system evolves, and that interpretation can remain bounded.
A queue leaves its expected range. Consumer throughput declines. Retries increase. Those observations may contribute to a status: DIVERGING. Persistence and additional evidence may support recognition of a situation: CONSUMER CAPACITY LOSS. The contributing observations remain inspectable. Confidence remains explicit. Uncertainty remains representable. Operators can descend toward supporting evidence when the situation demands it. The architecture develops intermediate forms of knowing between raw telemetry and human investigation.
The organizational failure
This brings us back to the house. A hoarded home is significant because its environment reflects the behavior that created it, and the same is true for an organization’s information environment. A telemetry archive containing trillions of observations reveals something about the organization’s ability to select, prioritize, and learn. Perhaps the organization lacks awareness of what it needs to remain sensitive to. Perhaps it lacks explicit models of the situations it needs to recognize. Perhaps each team manages uncertainty locally and sends unresolved issues to shared storage. Perhaps incidents improve data collection more reliably than they improve recognition. Perhaps the archive has become a repository for the organization’s unresolved uncertainties.
That is more serious than a storage problem. It is an executive-function problem at organizational scale.
The challenge lies in inhibition: what should we cease collecting? It manifests in prioritization: which distinctions hold significance? It emerges in learning: what should past incidents enable us to discern sooner? It surfaces in forgetting: which evidence has fulfilled its purpose? And it appears in orientation: what situations are we genuinely attempting to recognize and control? Without answers to these questions, accumulation becomes predictable. The organization lacks the confidence to discern significance, so it opts for possibility.
Information that never circulates
When things change in an operation, it’s important to keep an eye on it. What we see helps us understand things better. Understanding helps us make better decisions. Decisions guide what we do. What we do affects the world around us. The results of our actions shape what we expect in the future. As we learn from our experiences, we bring back what we’ve learned to the system, making it stronger and more capable.
Something like: observation → interpretation → judgement → action → consequence → learning
Telemetry is like: production → ingestion → indexing → retention → expiration
It arrives. It waits. It disappears. Most of it never contributes to a meaningful change in the observing system.
The hoarding metaphor isn’t just about how much stuff you have; it’s about how well you’re sharing what you know.
The real issue is that information isn’t flowing through the organization in a way that helps everyone learn from it. Each new piece of data comes in, but the organization doesn’t quite know how to put it together to make sense of the future. So, another day goes by, another month passes, and another problem becomes a report. The archive gets bigger, and the organization keeps seeing things the same way.
Forgetting as an organizational capability
Situational awareness demands selective attention, recognition, modeling, and control. Organizations must possess the same capacity to make these selective decisions. Some observations should be quickly dismissed, while others should alter a short-lived status, strengthen expectations, weaken them, contribute to recognizing a developing situation, or remain because audit, regulation, reconstruction, or uncertainty makes them valuable.
The crucial aspect here is discrimination. What has significance.
A system that lacks the ability to determine what can safely be abandoned has a reliable response to uncertainty: retain it and then search it later. An event occurs, prompting a person to search, correlate, and reconstruct the situation. The incident concludes, and the archive expands. A similar occurrence happens again, triggering another search. How many times must an organization experience the same situation before the experience transforms the organization?
Stepping outside the box
The observability industry is increasingly acknowledging the significance of telemetry pressure. Improving compression, reducing storage costs, implementing selective routing, optimizing pipelines, and utilizing faster query engines can all help mitigate this pressure. Furthermore, AI can assist users in navigating the vast amounts of accumulated data. Together, these advancements enhance the capabilities of the existing observability framework.
The deeper question concerns the frame itself.
Situational awareness requires the observer to change through experience. A system that has encountered something repeatedly should become more capable of recognizing it. A system encountering unfamiliar behaviour should recognize the departure from expectation. A system with growing confidence should need less supporting detail. A system facing uncertainty should preserve more. Operational memory should appear as changed sensitivity.
That suggests a different measure of progress. How much can we ingest? How quickly can we search it? How efficiently can we store it? These remain useful questions. Another question reaches closer to situational awareness: How much historical evidence must be revisited before the organization can determine what situation it is in?
Experience should change the answer.
Observability has spent years improving the box, making it larger and making it easier to search. Situational awareness begins by questioning why so much understanding still has to be recovered from inside it.
The house behind the search box
Imagine every production log printed onto paper. Every span another sheet. Every repeated attribute printed again. Every retained month requiring another room. Soon the engineering office disappears beneath the evidence.
Then the questions become unavoidable. Why are we keeping all of this? What did yesterday’s pile teach us? Which patterns have become understood? Which details still matter? Why does today’s incident begin with another search? What does this environment tell us about the organization that produced it?
Software hides the pile, and the search box hides it even better. Behind that small empty rectangle sits the accumulated evidence of everything the organization has seen, and surprisingly little evidence that seeing has changed how it sees. The house looks tidy because the walls conceal the accumulation.
If we could see the information environment we have created, we might stop treating it purely as infrastructure. We might start treating it as evidence about ourselves. And then the question becomes much harder to ignore:
How can anyone operate like this?