Separate control-plane access, ingestion, query, dashboards, alert evaluation, and notifications. Record tenant region, data type, collector/client version, query or monitor ID, error, and UTC time. Check ingestion timestamps and notification delivery before replaying data or alerts.