Packt · 3-hour online workshop
Building a Network Observability Stack with Tools, Automation, and AI¶
The whole stack on your laptop, and one alert walked end to end.
Three hours, one laptop, one on-call investigation. You'll write PromQL and LogQL against live telemetry and find the peer that's quietly broken. You'll watch a flap-rate dashboard get built with thresholds that match the alert rule. Then you'll drive an automated alert response yourself — alert, evidence, policy, action — flip one flag in the source of truth and watch the same alert reach the opposite decision, with an AI-written root-cause narrative stapled to the audit record. By the end you'll know which of those calls you'd hand to automation and which you'd keep.
What you'll do¶
-
Part 1 — Telemetry and queries
~55 min · hands-on
Morning of your first deep day on the rotation. Walk the lab's metrics and logs with your senior buddy, find the broken peer, and bridge a metric anomaly to the log line that explains it. Ends with ten minutes of your own queries.
-
Part 2 — Dashboards and alerts · guided demo
Watch only
A post-mortem email lands: last night's page lost ten minutes because a flap-rate panel didn't exist. We build it on screen, match the real alert rule, overlay its firing window, then silence a notification. Part 3 starts from a clean lab state.
-
Part 3 — Alerts, automation and AI
Hands-on
A real alert lands. Walk the cycle — alert, facts, decision, action — then flip one intended-state flag and watch the same alert reach the opposite decision. Read the root-cause summary and decide what you'd trust it on at 02:14.
Two lanes — pick the one your laptop allows
Hands-on. Your laptop runs the stack and you type along. Better experience, and the pre-work is what makes it work — do it a few days ahead, not on the morning.
Watching. Locked-down machine, not enough RAM, no time to prepare? Come anyway. Every command and every expected output is written out in the guides, and the Take it home page lets you do the hands-on parts later with more time than three hours allows.
Part 2 is a guided demo for everybody, so a stack that's still pulling images by then costs you nothing.
Questions people ask before signing up¶
Do I need network engineering experience?
Helpful, not required. Every concept the workshop leans on — BGP peering, interface state, syslog UPDOWN events — is framed before you query it. If you have run a network, you'll move faster; if you have run a platform, you'll recognise more of the tooling than you expect.
Do I need to know Prometheus, Loki, or Grafana already?
A sketch-level idea of "metrics database" and "log database" is enough. Part 1 builds PromQL and LogQL from first principles against live data — no prior query-language experience assumed.
What if I've never used Docker?
You need Docker installed and running, but you never write a Dockerfile. If docker ps works on your laptop, you're set. The pre-work page has per-platform install pointers and a nobs preflight command that checks everything at once.
Why do I need uv?
uv installs and runs the workshop's nobs CLI — the thin wrapper that fronts every command (up, down, status, alerts, flap-interface). One install line, and it brings its own Python, so you don't need a system Python at all.
I'm on Windows.
Run everything inside WSL 2, with Docker Desktop on the WSL 2 backend. Not PowerShell, not Git Bash. If you have never set WSL up, do it a few days ahead rather than on the morning.
How big is the stack?
Around 21 containers, ~5.5 GB of RAM while running, and ~5 GB of disk. The first nobs packt up pulls 3–5 GB of images — that's the only genuinely slow step, and it's why the pre-work matters. After that, restarts are seconds. nobs packt destroy removes all of it.
Is anything sent to a remote service?
No, by default. All telemetry, alerts, dashboards and audit records are local. The AI RCA step defaults to a demo provider that writes its narrative from a local template — no network calls. It only reaches OpenAI or Anthropic if you put your own key in .env, which is entirely optional and not needed for any part of the session.
Where do I ask questions?
During the session, through the Q&A panel in Packt's app. Before and after, open an issue on the workshops repo — a stuck pre-work install is fair game.
After the three hours¶
The stack is still on your laptop and it costs nothing to leave it there. The Take it home page collects everything we couldn't fit — recording rules and alert rules, the full ten-step panel build, swapping the demo RCA provider for a real LLM, and the end-to-end 02:14 capstone where the page lands and you're alone on the rotation.
If you want the long-form version of all of it, Modern Network Observability is the book this workshop is drawn from, and network-observability-lab is its chapter-by-chapter playground with real SR Linux and cEOS containers in the loop.