canonical_url: leave empty so this dev.to post is the canonical home,

or point it at your GitHub write-up if you prefer that as the original.

A memory spike showed up on a Grafana dashboard for a small lab I run. I checked the logs. They said nothing happened.

That "nothing" turned out to be the whole clue.

This is a short detective story about network observability — and about why "just check the logs" is only half the job. I got the first two guesses wrong, which is the interesting part, so I'll leave the mistakes in.