Cribl Monitoring & Troubleshooting Flashcards

Which built-in Cribl tool allows you to inspect live events flowing through a pipeline without modifying the pipeline?

Answer: Live Data Capture (Preview)

Cribl's Live Data Capture (Preview) lets operators view a sample of events passing through a pipeline in real time without altering the pipeline configuration.

In Cribl Stream, what metric indicates that a destination is experiencing backpressure?

Answer: Persistent Queue depth increasing over time

A growing Persistent Queue depth signals that events are accumulating faster than the destination can accept them, indicating backpressure.

What is the purpose of the Cribl System Metrics dashboard?

Answer: To monitor CPU, memory, and throughput of the Cribl deployment in real time

The System Metrics dashboard provides real-time visibility into resource utilization (CPU, memory) and data throughput across the Cribl deployment.

When a Cribl Worker node stops sending heartbeats to the Leader, what state does the Leader assign to that worker?

Answer: Unreachable

If a Worker node fails to send heartbeats within the expected interval, the Leader marks it as 'Unreachable' in the deployment status.

Which Cribl log file should you check first when diagnosing a failed pipeline function?

Answer: cribl.log on the affected Worker node

The cribl.log on the Worker node executing the pipeline contains runtime errors and stack traces from failed pipeline functions.

What does the 'Dropped Events' counter in Cribl's destination metrics indicate?

Answer: Events that could not be delivered and were discarded due to no persistent queue or full queue

Dropped Events counts events that Cribl was unable to deliver to a destination and had no persistent queue to buffer them, resulting in data loss.