ClickHouse patches a critical flaw that could let unauthenticated users run code on the server
CVE-2026-116366 is rated 9.5 under CVSS 4.0. Fixed in four ClickHouse lines; Cloud is patched. Langfuse pinned its compose file. What to upgrade.
Topic · 18 stories
18 stories tagged observability on AI Tamer, newest first.
CVE-2026-116366 is rated 9.5 under CVSS 4.0. Fixed in four ClickHouse lines; Cloud is patched. Langfuse pinned its compose file. What to upgrade.
Cloudflare's 13 October changelog says the API MCP server posts Workers Issues to a client webhook. Issues is an open beta and free during the beta.
Use an Istio VirtualService to copy live requests to a candidate model deployment, discard its responses, and compare its errors and latency with the stable version.
Linux records how much CPU time a process has used, never a percentage. Every percent figure is a difference over an interval, which is why ps and top disagree and why a tool can print a confident zero.
OpenTelemetry baggage can leave an AI service in outbound HTTP headers. Check what a model API receives and limit propagation at that boundary.
A Collector can accept spans while its exporter falls behind. Its internal metrics show where delivery slows, where data is refused, and when loss becomes likely.
A trace can show which model calls and tool runs produced an agent response, where the time went, and how many tokens each call used.
Python context variables let asynchronous tasks read a request ID without passing it through every function call. The key is when each task receives its context.
A response can be slow to start or slow to continue. vLLM exposes separate metrics for those delays, making each easier to investigate.
Head sampling controls trace volume early. Tail sampling can retain runs that later fail or become slow, if the pipeline can hold and route their spans.
Inference requests can wait while CPU utilization stays below its scaling target. Measure pending work and queue delay to decide when more workers are useful.
A lasting agent operation has a start and an end. Named, timestamped events show when approvals, state changes, and failures occurred along the way.
A user ID on a Prometheus metric creates series across other label dimensions. Here is how that affects storage and queries, and how to keep useful operational detail.
Agent logs are tempting to fill with everything: prompts, tool calls, environment, full requests. A short list of what must never land in them, and why scrubbing has to happen before the write.
LiteLLM (Oct 1, 2026) launches Lens: AI agents investigate production agent traces at the gateway. Traces land in customer-run ClickHouse; self-host via Docker Compose with OTLP /v1/traces and /lens APIs.
Honeycomb (Sep 29, 2026) made Canvas Connectors generally available—“12 connectors and growing”—plus Anomaly Detection GA. AI Ecosystem and LLM cost tracking stay early access.
Sep 30 User Insights update for AI Gateway: model-fit Overkill/Appropriate/Underpowered, task+turns analysis, Potential Savings. Free for Gateway users (inference still billed). Distinct from Auto Router. Async ~1 day lag; log classification opt-in per gateway.
CoreWeave Forge (Fully Connected 2026 / Sep 30 news): connected run→observe→curate→improve→evaluate loop. Only CoreWeave ARIA and CoreWeave Sandboxes are explicitly Generally Available, not all of Forge. CoreWeave Forge is not Cloudflare Forge. Claims are CoreWeave’s; Agent Lens cost wording differs between the blog and the news release.