Cribl Cribl Monitoring & Troubleshooting 1 — Questions and Answers
Question 1: Which built-in Cribl tool allows you to inspect live events flowing through a pipeline without modifying the pipeline?
- Live Data Capture (Preview) (Correct answer)
- Pipeline Profiler
- System Metrics Dashboard
- Audit Logs
Correct answer: Live Data Capture (Preview)
Cribl's Live Data Capture (Preview) lets operators view a sample of events passing through a pipeline in real time without altering the pipeline configuration.
Question 2: In Cribl Stream, what metric indicates that a destination is experiencing backpressure?
- Persistent Queue depth increasing over time (Correct answer)
- CPU usage dropping below 10%
- Source event rate increasing
- Worker Group count decreasing
Correct answer: Persistent Queue depth increasing over time
A growing Persistent Queue depth signals that events are accumulating faster than the destination can accept them, indicating backpressure.
Question 3: What is the purpose of the Cribl System Metrics dashboard?
- To monitor CPU, memory, and throughput of the Cribl deployment in real time (Correct answer)
- To visualize pipeline routing logic
- To manage source and destination certificates
- To configure worker group scaling policies
Correct answer: To monitor CPU, memory, and throughput of the Cribl deployment in real time
The System Metrics dashboard provides real-time visibility into resource utilization (CPU, memory) and data throughput across the Cribl deployment.
Question 4: When a Cribl Worker node stops sending heartbeats to the Leader, what state does the Leader assign to that worker?
- Unreachable (Correct answer)
- Idle
- Standby
- Draining
Correct answer: Unreachable
If a Worker node fails to send heartbeats within the expected interval, the Leader marks it as 'Unreachable' in the deployment status.
Question 5: Which Cribl log file should you check first when diagnosing a failed pipeline function?
- cribl.log on the affected Worker node (Correct answer)
- access.log on the Leader node
- audit.log in the management UI
- The destination queue log
Correct answer: cribl.log on the affected Worker node
The cribl.log on the Worker node executing the pipeline contains runtime errors and stack traces from failed pipeline functions.
Question 6: What does the 'Dropped Events' counter in Cribl's destination metrics indicate?
- Events that could not be delivered and were discarded due to no persistent queue or full queue (Correct answer)
- Events that were successfully routed to a secondary destination
- Events filtered out by pipeline conditions
- Events compressed before forwarding
Correct answer: Events that could not be delivered and were discarded due to no persistent queue or full queue
Dropped Events counts events that Cribl was unable to deliver to a destination and had no persistent queue to buffer them, resulting in data loss.
Cribl Cribl Monitoring & Troubleshooting 1
Which built-in Cribl tool allows you to inspect live events flowing through a pipeline without modifying the pipeline?