Project Sentinel is a custom pattern for answering one question each morning from a single place: is the data behind our dashboards current, complete, and correct? Instead of checking the orchestrator, the ingestion jobs, the transformation layer, and the BI tool one at a time, a small set of collectors writes health metadata for every layer to a shared store, and an AI agent turns the qualifying failures and anomalies into one Slack digest. The approach is described by its author in a first-person DEV Community write-up by gentjan_likaj, indexed as published September 29, 2026. It is a practitioner’s account of an implementation, not an independent evaluation.
The question that motivates it is the one stakeholders ask most often: “The dashboard looks off. Is the data updated?” A green orchestration run does not answer that. As the author puts it, “Green pipelines don’t mean correct data.”
As an Amazon Associate I earn from qualifying purchases.
Why a green pipeline is not enough
Most data teams already monitor their jobs. An orchestrator marks a DAG as successful, a load finishes without raising an error, and a transformation model builds. Each of those signals is true and each is narrow. None of them tells you whether the row count dropped by half, whether a revenue KPI moved for reasons unrelated to the business, or whether a Tableau extract still reflects yesterday’s source.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe author’s example makes the gap concrete. A pipeline can report success while its output is wrong in three distinct ways: the volume of rows has changed, a business metric has shifted unexpectedly, or a report-level value no longer matches the source of truth. Sentinel is built to surface those silent failures alongside the loud ones.
#1 Best Overall
The stack the example monitors
The example pipeline is AWS-centered. APIs and databases feed AWS Glue jobs, which load Amazon Redshift; dbt transforms the data inside Redshift and builds a further layer there; Tableau reads the output. Airflow coordinates the runs. Each layer fails in a different way, which is why a single job-status check is not sufficient.
| Layer | Tool in the example | Typical failure that stays hidden | What Sentinel checks |
|---|---|---|---|
| Orchestration | Airflow | A run finishes late, retries silently, or misses its deadline | Latest state, duration against average, task retries, owner, SLA status |
| Ingestion | AWS Glue | A job succeeds but one partition or file was skipped | Recent run status, duration, error message, per-run parameters |
| Transformation and sources | dbt, Redshift sources | Source data is stale or row volume collapses | Model executions and errors, source freshness, row volume against the same weekday last week |
| Business metrics | Warehouse KPI tables | Costs, leads, sessions, or orders shift without a pipeline error | Core KPIs against the same day last week, skipping very small values |
| Reporting | Benchmark source of truth | A report drifts from its source or history gets restated | North Star KPI compared with a benchmark |
| Presentation | Tableau | An extract refresh fails and the dashboard shows stale numbers | Failed extract refreshes, mapped to datasource owners |
How the pieces fit together
Sentinel separates collection from reporting. Producers and consumers never talk directly; they meet at a common store of JSON health files. The sequence runs as follows.
- Collectors write health metadata. Each collector writes a JSON health file for its layer to Amazon S3.
- A thin internal API exposes the files. A small HTTP service reads a requested health file from S3 and returns it as JSON.
- Airflow starts an agent session. After the collectors finish, Airflow launches a short-lived agent session with a version-controlled prompt and shell access.
- The agent queries the gateway. It calls the gateway endpoints for each layer and retrieves the health records.
- Failures and anomalies are filtered and mapped. Qualifying records are filtered, mapped to their owners, and noisy errors are reduced to a probable root cause.
- One Slack post is composed. The post is either an all-clear or a grouped list of issues with owners tagged.
Because the health files sit in S3, the author presents several side benefits: producers are decoupled from consumers, payloads can be inspected and replayed, and any HTTP-capable consumer can use the same data. These are design claims from the author. The write-up does not test them independently.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat each layer reports
Airflow
For each DAG, Sentinel records the latest pipeline state, how the current duration compares with the average, the number of task retries, the owner, and SLA status. SLA deadlines are set as times of day. A failure callback writes a meaningful error line to S3 on a best-effort basis, so the digest can explain a failure rather than just flag it. Because the callback is best-effort, a missing error line should be treated as a gap in the context, not as evidence that nothing went wrong.
AWS Glue
For each job, Sentinel captures recent run status, duration, and the error message. Jobs that run many times a day need more than the latest status. The author retains per-run parameters so the report can identify which partition or file failed, which turns a vague “ingestion failed” into a specific retry target.
Rank #2
dbt and source tables
Sentinel records model executions and errors from dbt. It also checks source freshness and compares row volume with the same weekday in the prior week. Comparing against the same weekday, rather than the previous day, is what allows the check to account for ordinary weekly cycles.
Business KPIs
Core metrics such as costs, leads, sessions, and orders are compared with the same day last week. The author skips very small values, because a small absolute movement can look like a large percentage change and produce noise. The write-up does not supply a threshold formula, so teams adopting the pattern will need to set their own cut-off and justify it against their own data.
Free tools Windows power users keep installed
One-click scans. No signup required.
The sample digest line in the write-up reads “~50% of last week,” which illustrates how a volume comparison is phrased. It is an example of output format, not a measured result.
North Star reconciliation
A reporting table is compared against a benchmark. This is how the pattern catches drift from a source of truth or a restatement of historical figures, which a pipeline status check would never flag.
Tableau
Sentinel identifies failed extract refreshes and the owner of each datasource so the issue can be routed to the right person rather than posted to a general channel without an owner.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Running the agent safely
The agent’s job is summarization and triage, not detection. Detection is deterministic. The author’s most important design choice follows from a failure they describe: in an earlier iteration, the model received the full payload and the input was truncated, so records were silently dropped and the digest reported a clean state that was not true. The lessons below are the author’s, and each addresses a specific way an LLM step can fail quietly.
Recommended Free Tools
Filter deterministically before the model reads anything
Do not ask the model to decide what to discard from a large payload. Filter every record with a deterministic step first; the author uses jq for this. The model then receives only the smaller set of qualifying records to summarize. The rule is simple: the model explains failures, it does not decide which failures exist.
Treat empty or broken replies as failures
An empty response from the agent, or a reply that does not parse, should fail visibly. Reporting success on a blank reply is the same silent-failure problem Sentinel exists to catch.
Do not blindly retry billable, non-idempotent steps
A retry of a step that posts to Slack or calls a paid API can create duplicates or extra charges. The author’s recovery for a failed post is to wait for the next scheduled run rather than retry automatically.
Tear down agent sessions
Each session should be closed after success or failure. A session left open after a crash consumes resources and keeps shell access alive longer than necessary.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Keep the prompt in version control
The prompt is code. Changes go through review in the same way as pipeline changes, so a wording change that alters what the digest reports can be traced and reverted.
Report partial outages instead of suppressing the digest
If one source cannot be reached, the digest should say so and deliver the results it has. Suppressing the whole digest because one source is down would hide the failures that are still visible.
What the author reports, and what is not established
According to the write-up, morning triage moved to a single Slack message; silent issues such as low volume, KPI shifts, and report drift became visible; owners were tagged on each issue; and the health metadata could feed other reports and agents. These are the author’s observations about their own environment.
The write-up does not provide measured alert accuracy, noise reduction, mean time to detection, time saved, or any comparison with other approaches. It is a single practitioner account, so it does not establish that the pattern will reduce noise or detect failures in another stack. Treat it as a worked design to adapt, not a benchmark.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Criteria for evaluating your own version
If you are deciding whether to build a pattern like this or adopt a monitoring product, these criteria follow from the failures described above:
Quick Recap
- Breadth of source integrations across orchestration, ingestion, transformation, and BI
- Support for freshness, volume, KPI, and report-level checks, not only job status
- Retention of failure context, such as per-run parameters and owner mapping
- Deterministic filtering and an audit trail for what the summary was built from
- Behavior during partial outages, including whether the digest still ships
- Controls against duplicate posts and retries of billable steps
- Operational overhead: who maintains the collectors, the gateway, and the prompt
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
