Situation: MAU drops 20% suddenly. First goal is determine if drop is real user behavior or a data/instrumentation issue, and stop any knee-jerk decisions.Root-cause checklist (quick, prioritized)1. Verify metric definition- Confirm MAU SQL/event definition hasn't changed (time window, dedupe, timezone).- Check recent deploys, config/ETL changes in last 24–72h.2. Check ingestion & pipeline health- Are events being received by ingestion (Kafka / Kinesis / collector)?- Have any downstream jobs failed (ETL, batch jobs)?3. Confirm segmentation & sampling- Did sampling rates change? Any new filters or cohort definitions?- Is a CDP/identity resolution change dropping user IDs?4. Investigate client-side instrumentation- Recent SDK/library upgrades, flag changes, mobile app releases.- Crash rate / session rate spikes that would reduce event emission.5. Cross-validate with orthogonal signals- Active devices, sessions, logins, revenue, API calls, error rates.Quick validation queries/examples- Ingestion count by hour (last 72h):sql
SELECT hour, COUNT(*) as events
FROM raw_events
WHERE event_date >= current_date - 3
GROUP BY hour
ORDER BY hour;
- Unique users by day (compare tracking vs auth system):sql
SELECT event_date, COUNT(DISTINCT anonymous_id) as tracked_users
FROM raw_events
WHERE event_date >= current_date - 30
GROUP BY event_date;
sql
SELECT date, COUNT(DISTINCT user_id) as auth_users
FROM auth_logs
WHERE date >= current_date - 30
GROUP BY date;
- Error/crash spikes:sql
SELECT date, SUM(crash_count) FROM app_health WHERE date >= current_date - 7 GROUP BY date;
People to involve (order matters)- Analytics/data engineering: pipeline logs, ETL failures, SQL fixes.- Engineering (backend/frontend/mobile): recent deploys, SDK changes, logging.- SRE/infra: ingestion/backpressure/queue issues.- Product analytics / PM: interpret business impact and prioritize mitigations.- Customer support / Sales: reports of outages or user complaints.Temporary mitigations to prevent incorrect decisions- Mark MAU as “investigating” in dashboards; freeze automated alerts/auto-scaling or business ops actions tied to MAU.- Create backup metric (e.g., active sessions or logins) as provisional KPI.- Rollback suspicious instrumentation/deploys if evidence points to them.- Add short-term dashboard annotations and Slack/ops channel to avoid misinterpretation by leadership.- If sampling/config change caused drop, temporarily revert sampling to previous level while investigating.Result tracking & next steps- Triage within 2 hours: confirm ingestion vs true behavior.- If instrumentation issue: patch and backfill missing events; recalc MAU and publish corrected numbers.- If real user change: run funnel, session, and cohort analysis to identify affected flows and prioritize fixes or experiments.This approach separates data issues from real user behavior, minimizes incorrect business actions, and ensures stakeholders have the right temporary signals while root cause is resolved.