OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail | AgentRules.org

Rules Stacks Clients Auditor Pruner Self-Heal RFCs Benchmark CLI CI/CD Authors Submit

This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →

devopscritical PriorityID: otel-collector-adaptive-backpressure-standard

OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail

Enforces strict memory limits, queue boundaries, and tail-sampling circuit breakers across OpenTelemetry Collector deployments. Prevents out-of-memory (OOMKilled) crashes and silent data drops during downstream degradation by coupling cgroup-aware memory limiters with bounded persistent or memory sending queues.

Prohibited Anti-Pattern: Unbounded Exporter Queues and Missing Memory Limiter Leading to Fatal OOM Cascades

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail - Enforces strict memory limits, queue boundaries, and tail-sampling circuit breakers across OpenTelemetry Collector deployments. Prevents out-of-memory (OOMKilled) crashes and silent data drops during downstream degradation by coupling cgroup-aware memory limiters with bounded persistent or memory sending queues.
globs: **/otel-collector*.{yaml,yml}, **/collector*.{yaml,yml}, **/helm/**/otel*.{yaml,yml}, **/k8s/**/otel*.{yaml,yml}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/otel-collector-adaptive-backpressure-standard"
---

# OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Unbounded Exporter Queues and Missing Memory Limiter Leading to Fatal OOM Cascades

## System Constraints
You are a Principal Observability and Infrastructure Architect enforcing production-grade resilience standards for the OpenTelemetry Collector. Mandate that every collector configuration contains proactive memory limiting, strictly bounded queues, and circuit-breaking mechanisms to survive severe traffic surges and downstream backend outages.

## Strict Guidelines
- Engineers MUST ALWAYS declare the `memory_limiter` processor as the very first processor in every pipeline (traces, metrics, logs).
- Engineers MUST configure `check_interval` to at most `1s` and set `limit_percentage` to no more than `80%` (or `limit_mib` to 75-80% of Kubernetes cgroup memory limit) with `spike_limit_percentage` set to `20%` (or `spike_limit_mib` to 15-20%).
- Engineers MUST NEVER deploy exporters with unbounded `sending_queue` configurations; `queue_size` MUST be explicitly calculated based on available worker memory and batch size.
- Pipelines using `tail_sampling` MUST define explicit sampling decision limits and timeout safeguards (`decision_wait`) to prevent state retention spikes during high trace cardinality.
- Receivers MUST return an HTTP 503 or gRPC `UNAVAILABLE` status immediately upon upstream backpressure activation rather than accepting telemetry into an unbuffered pipeline.
- The deprecated memory ballast configuration (`ballast_size_mib`) MUST NOT be used in any environment.

## Bad vs Good Implementations
### OpenTelemetry Collector Pipeline Backpressure Configuration

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Omitting the memory_limiter processor leaves the collector completely vulnerable to memory exhaustion when ingestion spikes. Downstream latency causes the default queue to exhaust heap allocations, causing the kernel to OOMKill the process (signal 9/137) and discard in-flight telemetry without backpressuring the client.
```yaml
# ANTI-PATTERN: No memory_limiter, unbounded queues, and tail_sampling placed without memory bounds
receivers:
  otlp:
    protocols:
      grpc: { endpoint: 0.0.0.0:4317 }
      http: { endpoint: 0.0.0.0:4318 }

processors:
  batch:
    send_batch_size: 10000
    timeout: 10s
  tail_sampling:
    decision_wait: 30s
    expected_new_traces_per_sec: 100000

exporters:
  otlp:
    endpoint: downstream.telemetry.svc:4317
    sending_queue:
      enabled: true
      # queue_size omitted: defaults to high/unbounded allocations

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [tail_sampling, batch] # Missing memory_limiter as first processor
      exporters: [otlp]
```

#### Production Standard (Correct)
> **Standard**: The memory_limiter is placed at the top of the pipeline to trigger immediate backpressure (HTTP 503 / gRPC UNAVAILABLE) to upstream agents before buffer exhaustion. The exporter queue is strictly bounded to 5,000 items with explicit consumer scaling, guaranteeing predictable memory ceilings.
```yaml
# PRODUCTION STANDARD: Memory limiter first, bounded queues, and fail-fast backpressure
processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 75
    spike_limit_percentage: 15
  batch:
    send_batch_size: 8192
    send_batch_max_size: 16384
    timeout: 5s
  tail_sampling:
    decision_wait: 5s
    num_traces: 50000
    expected_new_traces_per_sec: 5000

exporters:
  otlp:
    endpoint: downstream.telemetry.svc:4317
    sending_queue:
      enabled: true
      num_consumers: 8
      queue_size: 5000
    retry_on_failure:
      enabled: true
      initial_interval: 1s
      max_interval: 30s
      max_elapsed_time: 5m

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [memory_limiter, tail_sampling, batch] # memory_limiter strictly first
      exporters: [otlp]
```

Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector

Inspects running OTel Collector pod resource limits, container restarts, and OOMKilled exit codes (137).

Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

OpenTelemetry Collector Config Validator

CLI utility to statically validate OpenTelemetry Collector configuration schemas and pipeline processor ordering.

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail

OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces strict memory limits, queue boundaries, and tail-sampling circuit breakers across OpenTelemetry Collector deployments. Prevents out-of-memory (OOMKilled) crashes and silent data drops during downstream degradation by coupling cgroup-aware memory limiters with bounded persistent or memory sending queues. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded Exporter Queues and Missing Memory Limiter Leading to Fatal OOM Cascades Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded Exporter Queues and Missing Memory Limiter Leading to Fatal OOM Cascades	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS declare the `memory_limiter` processor as the very first processor in every pipeline (traces, metrics, logs).

Engineers MUST ALWAYS declare the `memory_limiter` processor as the very first processor in every pipeline (traces, metrics, logs).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

2

Engineers MUST configure `check_interval` to at most `1s` and set `limit_percentage` to no more than `80%` (or `limit_mib` to 75-80% of Kubernetes cgroup memory limit) with `spike_limit_percentage` set to `20%` (or `spike_limit_mib` to 15-20%).

Engineers MUST configure `check_interval` to at most `1s` and set `limit_percentage` to no more than `80%` (or `limit_mib` to 75-80% of Kubernetes cgroup memory limit) with `spike_limit_percentage` set to `20%` (or `spike_limit_mib` to 15-20%).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

3

Engineers MUST NEVER deploy exporters with unbounded `sending_queue` configurations

Engineers MUST NEVER deploy exporters with unbounded `sending_queue` configurations; `queue_size` MUST be explicitly calculated based on available worker memory and batch size.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

4

Pipelines using `tail_sampling` MUST define explicit sampling decision limits and timeout safeguards (`decision_wait`) to prevent state retention spikes during high trace cardinality.

Pipelines using `tail_sampling` MUST define explicit sampling decision limits and timeout safeguards (`decision_wait`) to prevent state retention spikes during high trace cardinality.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

5

Receivers MUST return an HTTP 503 or gRPC `UNAVAILABLE` status immediately upon upstream backpressure activation rather than accepting telemetry into an unbuffered pipeline.

Receivers MUST return an HTTP 503 or gRPC `UNAVAILABLE` status immediately upon upstream backpressure activation rather than accepting telemetry into an unbuffered pipeline.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

6

The deprecated memory ballast configuration (`ballast_size_mib`) MUST NOT be used in any environment.

The deprecated memory ballast configuration (`ballast_size_mib`) MUST NOT be used in any environment.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is OpenTelemetry Collector Adaptive Backpressure and Memory Limiter Guardrail critical for AI coding assistants?

Enforces strict memory limits, queue boundaries, and tail-sampling circuit breakers across OpenTelemetry Collector deployments. Prevents out-of-memory (OOMKilled) crashes and silent data drops during downstream degradation by coupling cgroup-aware memory limiters with bounded persistent or memory sending queues. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unbounded Exporter Queues and Missing Memory Limiter Leading to Fatal OOM Cascades) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

OpenTelemetry