Alibaba Cloud Media and Entertainment China Translated from Chinese

Morefun Entertainment Group (魔方文娱集团)

IT Operations Automation

Morefun's ticketing and event platforms needed to hit a 1-minute detection, 5-minute diagnosis, and 10-minute recovery target, but its older monitoring stack had blind spots, alert storms, fragmented trace and log tooling, and poor scalability under peak ticket-release traffic. The company also needed a way to turn large volumes of observability data into actionable incident intelligence instead of forcing engineers to correlate dashboards, traces, and logs manually.

60% of common faults now support automatic detection, diagnosis, and repair
average fault-detection time fell from 8 minutes to under 1 minute
core-link monitoring coverage increased from 65% to 99.5%
effective alerts increased to 90% of the total

Reported impact

Business outcome

Morefun turned observability into an operating system for reliability engineering. Core-link monitoring coverage rose from 65% to 99.5%, average fault-detection time dropped from 8 minutes to under 1 minute, and root-cause location fell from 15 minutes to 8 minutes. The company also reduced alert noise, automated much of routine incident handling, cut off-hours compute cost and cold-data storage cost, and improved service stability for high-concurrency ticketing peaks.

  • Cost Reduction
  • Customer Experience
  • Productivity Improvement
  • Risk Reduction

Solution

Morefun rebuilt its observability stack on Alibaba Cloud as an AIOps platform instead of separate monitoring tools. LoongCollector centralizes application logs into Log Service SLS, ARMS agents trace requests from page and API entry points through backend microservices, databases, caches, and message queues, and Managed Service for Prometheus collects infrastructure and container metrics across the fleet. Cloud Dial Test adds synthetic availability and latency checks from the user perspective, while Grafana surfaces shared dashboards. ARMS alert management normalizes multi-source alarms, routes them by business context, and preserves lifecycle records for SLO follow-up. On top of that observability data base, Morefun added an Observable MCP Server workflow that uses large-model reasoning to cluster related alarms, infer likely root causes, and generate diagnostic reports with remediation suggestions, turning incident response into an AI-assisted closed loop.

Data flow

Application logs are ingested by LoongCollector into SLS, traces are captured by ARMS agents, infrastructure and middleware metrics are written to Managed Service for Prometheus, and Cloud Dial Test adds external availability probes. Those streams are correlated in dashboards and alert pipelines, then Observable MCP Server applies large-model reasoning to cluster alarms, infer root causes, and emit diagnostic reports that guide follow-up actions.

Solution architecture

7 components · 5 layers
  1. Ingest
    • LoongCollector Collects Morefun's containerized application logs and forwards them into the centralized observability stack.
    • Cloud Dial Test Runs user-perspective synthetic checks to verify service availability and performance outside the data center boundary.
  2. Storage
    • Log Service SLS Stores and analyzes ticketing-platform logs so incidents can be queried, correlated, and investigated from one place.
  3. Serving
    • Grafana Presents unified observability dashboards for different business teams and operations war rooms.
  4. Orchestration
    • Observable MCP Server Uses AI workflows to group alarms, summarize likely causes, and generate actionable incident reports for engineers.
  5. Governance
    • Application Real-Time Monitoring Service (ARMS) Captures full request traces, performance breakdowns, and alert events across Morefun's application stack.
    • Managed Service for Prometheus Collects infrastructure, container, and middleware metrics for flexible drill-down analysis and alerting.

Architecture clues

  • ARMS alert management is used as the central event router and lifecycle tracker for SLO-driven response.
  • Grafana large-screen dashboards are part of the production operating model for major event traffic peaks.
  • Logs, metrics, traces, and synthetic user checks are correlated instead of being stored in separate monitoring silos.
  • Observable MCP Server turns alarm streams into AI-generated daily reports and remediation suggestions.

Evidence from the source

After the redesign, core-link monitoring coverage rose from 65% to 99.5%, fault detection dropped from 8 minutes to under 1 minute, root-cause location fell to 8 minutes, and overall alert volume dropped 85%. (original: 关键业务链路的监控覆盖率由原来的 65% 大幅提升至 99.5%……故障平均发现时间从 8 分钟缩短至 1 分钟以内;根因定位时间由 15 分钟压缩至 8 分钟……整体告警数量下降 85%。)
Monitoring blind spots, alert storms, fragmented tracing, and scattered log queries were blocking Morefun's 1-minute detection, 5-minute diagnosis, and 10-minute recovery target. (original: 监控盲区导致关键链路异常无法及时捕获,而告警风暴则在故障发生时淹没有效信息,使值班人员陷入“告警疲劳”;故障定位仍高度依赖人工经验与跨系统手动排查,链路追踪碎片化、日志查询分散,极大拖慢响应节奏。)
Morefun built a unified panoramic observability architecture around Alibaba Cloud Log Service SLS, ARMS, Prometheus, and Cloud Dial Test. (original: 技术同学以阿里云可观测产品为核心构建了一体化、全栈覆盖的全景监控架构……日志服务 SLS、应用实时监控服务 ARMS、可观测监控 Prometheus 版、云拨测。)
The team introduced an AI-plus-observability workflow where a large model clusters cross-service alarms, infers likely causes, and generates daily visual reports with recommendations. (original: 通过融合大模型能力与全链路观测数据,构建基于 AI+ 可观测性(Observability)的智能运维工作流……通过大模型对跨服务、跨层级的告警进行归因聚类,识别出真正具有业务影响的共性问题,并在每日生成的个性化报告中呈现潜在根因推测以及可落地的优化建议。)
Transparency Evidence & methodology 100/100 reference value · 95% confidence · 1 source

Review how this reference was scored and trace each normalized claim back to its documented source.

01

Scoring methodology

How scores are calculated

Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.

Customer reference value100/100
  • Problem clarity20/20
    Measures whether the customer's operational problem is specific enough to compare.
  • Implementation depth25/25
    Rewards named components, data flow, integrations, and architecture detail.
  • Outcome specificity20/20
    Measures whether the reported benefit is concrete rather than a generic claim.
  • Quantified impact25/25
    8 metrics describe measurable impact.
  • Deployment scale10/10
    Rewards evidence of a live or scaled deployment and meaningful integration scope.
Evidence confidence95%
  • Source authority20/25
    The main evidence is an official vendor-published customer story.
  • Claim traceability25/25
    12 of 12 key fields link to a named source.
  • Direct evidence20/20
    4 direct source quotes retained.
  • Date provenance10/10
    The publication date comes from the source page or publisher.
  • Source transparency10/10
    1 source reference document publisher, URL, authority, retrieval, and supported fields.
  • Implementation specificity10/10
    Rewards source-backed components, data flow, quantified impact, and a specific outcome.
02

Traceability

Sources & provenance

Field coverage shows which facts each source supports. Dates are shown only when documented by the source.

  1. Alibaba Cloud

    魔方文娱基于阿里云可观测产品构建下一代可观测体系

    First-party
    https://www.aliyun.com/customer-stories/culture-2025-morefun
    Source type
    Vendor-published customer story
    Supports
    • Customer
    • Region
    • Company size
    • Business problem
    • Solution
    • Products
    • Solution components
    • Data flow
    • Integrations
    • technical area
    • use case category
    • Business outcome
    • outcome category
    • Metrics
    • Architecture
    • evidence quotes

Date evidence

  • Published on source page Nov 4, 2025 · Alibaba Cloud · First-party
    Open date source
Not separately sourced Industry. Treat these normalized attributes as lower-confidence until a dedicated source is added.