Configuration drift happens when the real state of a system no longer matches the configuration that is supposed to define it. A hotfix typed directly on one server, a package upgraded by hand or a firewall rule added in a console are all typical sources.
Why it matters
Drift makes servers that should be identical behave differently, so a bug appears on one node only, or a deployment works in staging and fails in production. It also makes disaster recovery risky: rebuilding from your code produces a system unlike the one that was running. And undocumented changes are a security risk when nobody knows which ports or users should exist.
Example
Compare a node against its expected state with a configuration management tool in check mode:
ansible-playbook site.yml --check --diff -l web03Output showing a changed nginx.conf or an extra package on web03 alone is drift. Fix it by updating the code and reapplying, not by editing the server again.
Common mistakes
- Making emergency changes by hand and never committing them to the source of truth.
- Allowing broad console access in environments managed as code.
- Fixing drift on one server while the template that creates new ones stays wrong.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.