Redis

Redis SLOWLOG: the misunderstood telemetry that catches half your incidents

Most teams ship Redis with default SLOWLOG settings and never look at it. Here's how to tune it, what to scrape from it, and the three Redis incident classes that only show up in SLOWLOG.

Published 2026-03-24·8 min read

Most teams ship Redis with default slowlog-log-slower-than = 10000 (10ms) and slowlog-max-len = 128, then never look at it. On a busy instance the 128 entries cycle in seconds and you’ve captured nothing useful. SLOWLOG done right is the most cost-effective Redis instrumentation on the planet.

On this page

Tune SLOWLOG once
Three Redis incidents only SLOWLOG catches
Latency monitor pairs with it
Four queries to extract signal
FAQ

Tune SLOWLOG once

# In redis.conf (persistent)
slowlog-log-slower-than 1000   # 1ms — catches all interesting commands
slowlog-max-len 1024            # 1024 entries — survives a burst

# Apply at runtime if needed
CONFIG SET slowlog-log-slower-than 1000
CONFIG SET slowlog-max-len 1024

Three Redis incidents that only SLOWLOG catches

KEYS *. A junior engineer added a debug script that runs KEYS * against a 50M-key instance every minute. Each call blocks Redis for 600ms. CPU graphs show normal utilization (it’s a single command thread, fully loaded for 600ms then idle for 60s). SLOWLOG shows the call.
SUNIONSTORE on huge sets. Application code computes a daily union of two big sets; this is O(N+M). 50ms once a day = invisible on metrics, very visible on SLOWLOG.
Lua script with surprise complexity. A Lua script that loops over a hash with HKEYS and was fine when the hash had 100 fields. Now it has 100k.

Latency monitor: complementary, not redundant

SLOWLOG records commands. LATENCY MONITOR records events. Different categories:

fork — bg-save / AOF rewrite forks. On a 30 GB instance these can take 1.5s.
aof-write — fsync stalls.
expire-cycle — the active expiration scan. Slow when the keyspace has many keys with TTL.
fast-command — a command that should be O(1) took longer. Often a sign of memory pressure or fragmentation.

CONFIG SET latency-monitor-threshold 100
LATENCY HISTORY fork
LATENCY HISTORY expire-cycle
LATENCY RESET fork

Four queries to extract signal

# 1. Top-N slowest in current SLOWLOG buffer
SLOWLOG GET 50

# 2. Per-command frequency
INFO commandstats

# 3. Per-database key counts (suspect KEYS / SCAN abuse on huge DBs)
INFO keyspace

# 4. Client-side breakdown
CLIENT LIST  -- look for clients with large idle / qbuf-free

FAQ

What's the overhead of slowlog-log-slower-than = 1000?+

Negligible. Each entry is ~150 bytes; 1024 entries is ~150KB. The threshold check is a single comparison per command.

Should I export SLOWLOG continuously?+

Yes — agent-side scrape every 30 seconds, drain via SLOWLOG GET + RESET, ship to your DBM. Otherwise the ring buffer overwrites entries you'd want.

Does Redis Cluster have a unified SLOWLOG?+

No — each node has its own. Aggregate cluster-wide in your monitoring layer; per-node is rarely the right view.

Keep reading

Redis

Redis monitoring in production: the 2026 guide

INFO, slowlog, latency monitor, keyspace notifications, big-key sampling — what to scrape from each, and the eight metrics that predict every Redis incident before it pages.

Anomaly detection on database metrics: why thresholds fail and what works

A walk through forecast bands, change-point detection, multi-variate anomaly, and the seasonality math that makes 'p99 over 200ms' the wrong alert by default — with the Postgres example that broke our last threshold.

← All posts