Determine circuit breaker error and latency thresholds to protect downstream services.
A circuit breaker opens once the observed error rate in its evaluation window exceeds a configured threshold, but only after a minimum request volume has been observed to avoid tripping on statistically insignificant samples: opens_when error_rate > threshold% AND volume ≥ min_volume. Once open, the breaker rejects requests immediately (failing fast) until the half-open timeout elapses, at which point it allows a limited number of trial requests through to test whether the downstream dependency has recovered.
trips_when = error_count >= threshold within rolling_window_sec
With very few requests, a single failure can produce a misleadingly high error rate (e.g. 1 failure out of 3 requests = 33%) — requiring a minimum sample size before evaluating prevents the breaker from flapping open on statistical noise during low-traffic periods.
The breaker allows a small number of trial requests through to the downstream dependency; if they succeed, the breaker closes and resumes normal traffic, if they fail, it reopens and restarts the half-open timeout, backing off from a struggling dependency.
20-50% is common for general-purpose circuit breakers, tuned lower for critical dependencies where you want to fail fast sooner, and higher for naturally noisy or already-degraded-tolerant dependencies where occasional errors are expected and acceptable.
Retries should generally be attempted before the circuit breaker's error count is affected by transient failures, or the breaker should count only post-retry failures — otherwise aggressive retrying can itself inflate the observed error rate and trip the breaker prematurely under partial degradation.