How I Built a Diagnostic Tool for a Legacy System With No Dev Budget, and Cut Incident Triage From 6 Hours to 20 Minutes

I'm part of a systems support team, where alongside diagnostics and incident troubleshooting I also do development work. One of the systems we support ingests telemetry from a large fleet of IoT trackers installed on vehicles. Every few seconds each device reports its coordinates and status parameters. An internal processing service turns that raw stream into higher level business objects: events, incidents, trips, that the rest of the platform consumes.
The system has been in pure maintenance mode for years. No development budget, no vendor to call. It still has to be supported though, people use it every day.
Every so often one device develops a hardware fault and starts “spamming”: emitting an abnormal volume of points or malformed events in a short window. That degrades the processing pipeline not only for that device, but for everyone sharing it.
Finding the culprit used to mean a first line engineer manually pulling several raw tables for the relevant day (events, incidents, raw points), cross referencing them by timestamp and device ID, and eyeballing the result for anomalous patterns.
With the events table alone running 2 to 3 million rows a day, that was a 6 to 7 hour job, basically an entire shift, with no guarantee of actually finding the source.
