DrP: Meta's Efficient Investigations Platform at Scale

2025-12-03

AI Summary

In large-scale systems, on-call engineers rely on manual procedures or ad-hoc scripts for incident investigation, resulting in high mean time to resolution (MTTR), elevated operational overhead, and diminished productivity. This paper introduces DrP—the first end-to-end automated investigation framework designed for heterogeneous domains including services, AI/ML, and mobile systems. DrP’s key contributions are: (1) a declarative SDK enabling low-code development of reusable, domain-agnostic analysis logic; (2) a distributed execution engine with a plugin-based architecture supporting high-concurrency diagnostics and deep integration with alerting, event management, and remediation systems; and (3) a unified abstraction layer that transparently insulates users from infrastructure heterogeneity. Deployed at scale within Meta, DrP executes ~50,000 analyses daily across 300+ engineering teams, reducing average MTTR by 20% overall and up to 80% in specific scenarios—significantly enhancing SRE responsiveness and system observability.

Technology Category

• Multiagent Systems: Distributed Problem Solving
• Knowledge Representation and Reasoning: Diagnosis and Abductive Reasoning
• Machine Learning: Scalability of ML Systems

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web
• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines

Abstract

Investigations are a significant step in the operational workflows for large scale systems across multiple domains such as services, data, AI/ML, mobile. Investigation processes followed by on-call engineers are often manual or rely on ad-hoc scripts. This leads to inefficient investigations resulting in increased time to mitigate and isolate failures/SLO violations. It also contributes to on-call toil and poor productivity leading to multiple hours/days spent in triaging/debugging incidents. In this paper, we present DrP, an end-to-end framework and system to automate investigations that reduces the mean time to resolve incidents (MTTR) and reduces on-call toil. DrP consists of an expressive and flexible SDK to author investigation playbooks in code (called analyzers), a scalable backend system to execute these automated playbooks, plug-ins to integrate playbooks into mainstream workflows such as alerts and incident management tools, and a post-processing system to take actions on investigations including mitigation steps. We have implemented and deployed DrP at large scale at Meta covering 300+ teams, 2000+ analyzers, across a large set of use cases across domains such as services, core infrastructure, AI/ML, hardware, mobile. DrP has been running in production for the past 5 years and executes 50K automated analyses per day. Overall, our results and experience show that DrP has been able to reduce average MTTR by 20 percent at large scale (with over 80 percent for some teams) and has significantly improved on-call productivity.

Problem

• Automates manual investigation processes to reduce incident resolution time
• Reduces on-call toil and improves productivity in large-scale systems
• Provides an end-to-end framework for scalable, automated incident analysis and mitigation

Innovation

• End-to-end framework automating investigations with SDK playbooks
• Scalable backend executing automated playbooks for incident resolution
• Plug-ins integrating playbooks into alerts and incident workflows