Building a graph-first monitoring platform at internet scale

Tencent's platform managed many databases and processing layers at once. In practice, users had to decide which system to query depending on whether they were exploring time-oriented telemetry, searching, running analytics, or traversing relationships. For data analysts, that decision was especially difficult without deep familiarity with the strengths and tradeoffs of each engine. For the platform management team, the cost was even clearer: more systems to operate, more upgrades and failure modes to manage, more governance to enforce, and a higher ongoing maintenance burden.

At the same time, the most valuable monitoring workflows were increasingly graph-shaped. The team needed to model real operational context - process behaviour, parent/child derivations, and traffic relationships - and then query that context fast during incidents. Their data came in two complementary streams: periodic process "snapshots" that capture the state of a host at a moment in time, and real-time changelogs that record process actions as time-series messages. From those inputs, Tencent builds a process tree where process IDs are nodes, process attributes are node properties, and derivation relationships are directed edges.

The core requirement wasn't only to build and query the graph - it was to keep the graph continuously updated and versioned. Each new snapshot or changelog updates the previous graph state, producing a new "tree" that must be available quickly enough to support policy judgment. When an alert triggers, engineers need to reconstruct context from a window of time leading up to the fault, find the first appearance of a process, and understand how the state evolved from one version to another. Doing this across multiple engines made the workflow slow, complex, and operationally expensive.