Investigation plan (goal: determine if MAU drop after pipeline refactor is a data bug, definition change, or real behavior)Immediate (0–4 hours) — Triage & quick wins- Notify stakeholders: Data Engineering (owner of refactor), Analytics Engineering, Product Manager, Backend owner, Customer Support. Declare incident and ETA for next update (initial: 4 hours).- Verify alerting/logs: check monitoring for job failures, increased latency, task retries, schema errors in pipeline orchestration (Airflow/DBT logs).- Quick metric sanity checks (SQL): - Total raw event count by day (pre vs post refactor). - Distinct user_id count in raw events vs in reporting table for the same period. - Sample query:sql
SELECT event_date, COUNT(*) AS events, COUNT(DISTINCT user_id) AS dau
FROM events_raw
WHERE event_date BETWEEN '2025-10-01' AND '2025-10-14'
GROUP BY event_date;
- Compare event timestamps (timezone/ingest time vs event time) for shifts.- Outcome: if raw events drop -> upstream data source/ingest issue (likely data bug). If raw events stable but reporting table drops -> pipeline transformation bug.Short (4–24 hours) — Root cause narrowing- Data lineage & code diff: - Review refactor PR/commit diff for changed filters, joins, dedup logic, date truncation, or new WHERE clauses that could exclude users. - Check deployment time and which environments were affected.- Build comparisons: - Row-level sample: join reporting table to raw events for a sample of user_ids to see if transformations dropped or altered identifiers (NULLs, changed hashed IDs). - Check dedup/aggregation windows — e.g., unintended GROUP BY or window frame change that collapses users.- Validate definitions: - Reconfirm MAU definition with Analytics/Product: time window, active event types, unique identifier, handling of bots/test users. - Run MAU calculation directly from raw events using canonical definition to compare with refactored pipeline output.- Stakeholders to contact: analytics engineer (for definition), data engineer (for code), product owner (for business context).- Outcome: if canonical raw recomputation matches pre-refactor levels -> bug in refactor. If both match new lower value -> definition change or real behavior.Medium (24–72 hours) — Deeper analysis & business checks- Cohort & funnel analysis: - Compare cohorts (by signup week) to see if drop concentrated in specific cohorts or across all users. - Funnel checks for key activation events to spot product regressions.- A/B, release timeline, product telemetry: - Check product releases, config flags, experiments deployed around refactor time with Product/Engineering. - Review backend error rates, latency, feature flags, and rollback history.- Audit data backfill possibility: - If a bug caused missing data, assess feasibility and cost of backfilling, estimate time.- Customer support signals: - Check support tickets/feedback for increased complaints or usage issues.- Outcome: if product telemetry shows errors or experiments changed -> likely genuine business impact. If only reporting differs -> data bug.Resolution & communication (72 hours)- If data bug: prioritize roll-forward/rollback and backfill. Communicate root cause, fix plan, ETA, and impact scope to stakeholders.- If definition change: document and get sign-off from Product/Analytics, update dashboards and historical calculations or version metrics.- If genuine business change: present analysis (cohorts, funnels, support signals), propose hypotheses and experiments to Product/Design, recommend monitoring thresholds.- Postmortem within 1 week: timeline, root cause, actions (tests, CI for metrics, lineage docs, alerting improvements), owners, and follow-up verification plan.Checks summary (concrete)- Raw event counts, distinct user_id counts- Timestamp vs ingest_time, timezone shifts- Schema/column nulls and type changes- Join keys and dedup logic- PR diffs for filter/WHERE logic- Recompute MAU from raw source- Product release/feature flags and backend error logs- Support ticket trendsTypical timeline: initial triage (0–4h), narrowing & code review (4–24h), deeper analysis & remediation plan (24–72h), fix/backfill and postmortem (3–7 days).