# How Salesforce Eliminated Single-Region Risk and Reduced Downtime Blast Radius at 4B Metrics/Min

[Salesforce](https://yomu.fyi/company/salesforce) · Scott Nyberg · Aug 5, 2026

**Type:** Problem & solution

## Summary

Salesforce redesigned its internal observability platform, Argus, to eliminate single-region failure risks while ingesting approximately 4 billion metrics per minute. Operating out of a single AWS region previously created a global blast radius and generated high cross-region data transfer costs. To mitigate these risks without the prohibitive expense of full multi-region replication, the engineering team implemented a geo-local architecture that processes and stores telemetry closer to its origin across production geographies. A newly introduced federation query layer relies on Elasticsearch mappings to route queries selectively to relevant regional clusters, avoiding broad fan-out. The platform also adopted metadata caching for wildcard queries and implemented HTTP 206 partial-response handling to maintain visibility when individual regions experience downtime.

## Context

Salesforce operates Argus, an internal observability platform ingesting approximately 4 billion metrics per minute. Originally deployed in a single AWS region, the platform faced major availability risks because an outage in that single region would take down observability globally. Furthermore, routing all metrics across data centers and regions into one central location incurred high data transfer costs and network latency, while full multi-region replication was cost-prohibitive.

## Approach / What changed

The team transitioned Argus to a geo-local architecture where metrics are processed and stored closer to their origin across production geographies using OpenTSDB and HBase. To query distributed data without full replication, a federation query layer was introduced that uses Elasticsearch mappings of metric scopes to selectively route queries to relevant regions instead of broadcasting. The system handles partial availability by returning HTTP 206 partial-response semantics with UI indicators, and accelerates wildcard query resolution using metadata caching.

## Takeaways

- Argus adopted a geo-local model where telemetry is processed and stored near its origin across multiple geographies, avoiding the infrastructure costs of full multi-region data replication.
- A federation query layer uses Elasticsearch mappings to map metric scopes to regions, routing queries only to relevant geographies to prevent unnecessary cross-region fan-out and latency.
- To handle partial regional outages gracefully during distributed queries, Argus returns HTTP 206 partial responses and surfaces UI indicators instead of failing silently.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [AWS](https://yomu.fyi/topic/aws), [Observability](https://yomu.fyi/topic/observability), [Reliability](https://yomu.fyi/topic/reliability), [Scalability](https://yomu.fyi/topic/scalability)

[Read original post](https://engineering.salesforce.com/how-salesforce-eliminated-single-region-risk-and-reduced-downtime-blast-radius-at-4b-metrics-min)