Operation, supervision and restoration

What to check every day and how to prove that data and service can be restored.

Audience: Operations Administrator, DBA, Service Desk, Security, Service Owner
Outcome: The operation has measurable controls, backups are tested, and the incident has a clear escalation.

Daily operation

container status and health checks; Zabbix can monitor availability and operational metrics
Application errors and failed integration queues; Sentry can catch application exceptions
disk, database and document storage capacity
expiration of certificates, keys and tokens
delayed processes, pending signatures and overdue tasks
backup and replication success

Grafana and Loki can provide centralized operational logs and reports based on the customer's architecture.
The application log must not contain passwords, tokens, or entire sensitive documents.
Each case and integration call uses a correlation ID.
The audit trail belongs in a managed audit, not just in the container's operational log.
The time of all nodes is synchronized and the time zone is explicitly set.
Retention of logs, audits, and documents is governed by separate rules.

Back up the database, persistent documents, configuration, templates, and process definition versions.
Save the list of image digests and release manifest; backing up the data alone is not enough.
Perform recovery to a separate environment and measure RPO/RTO.
After the restore, run the same smoke test as after the installation.
Record the result of the recovery test, including missing dependencies and the fix.

L1 collects time, user, case, correlation ID, version, and reproduction steps.
A security incident is not handled as a routine error and proceeds according to the organization's plan.
L2 verifies configuration, integration, and known release issues.
L3 DERS will receive minimized data, relevant logs, and an accurate version/digest.
After the repair, the original case, similar cases, and the completeness of the audit trail are verified.

Next runbook