Cribl Source & Destination Configuration 5 — Questions and Answers
Question 1: What is the purpose of the Consumer Group setting when configuring a Kafka source in Cribl?
- Set the number of consumer threads per worker
- Allow multiple Cribl workers to coordinate topic consumption without duplicate reads (Correct answer)
- Define the list of topics to subscribe to
- Configure Kafka broker authentication credentials
Correct answer: Allow multiple Cribl workers to coordinate topic consumption without duplicate reads
The consumer group setting allows Cribl worker processes to coordinate so each Kafka partition is consumed by only one worker, preventing duplicate event processing.
Question 2: Which authentication method does the Azure Event Hub source in Cribl use to connect to the event stream?
- OAuth 2.0 client credentials flow
- Shared Access Signature (SAS) connection string (Correct answer)
- Basic username and password
- Mutual TLS (mTLS) certificate
Correct answer: Shared Access Signature (SAS) connection string
The Azure Event Hub source uses a Shared Access Signature (SAS) connection string to authenticate with Azure Event Hub.
Question 3: What happens to events at a Cribl source when the downstream pipeline or destination cannot keep up with the ingestion rate?
- Events are immediately dropped at the source input
- Backpressure propagates upstream to slow down or block the data producer (Correct answer)
- Events are buffered indefinitely in JVM heap memory
- A new worker process is automatically spawned to handle the load
Correct answer: Backpressure propagates upstream to slow down or block the data producer
Cribl propagates backpressure upstream to the data producer when the downstream pipeline or destination cannot process events fast enough.
Question 4: Which dedicated source type should you configure in Cribl to receive OpenTelemetry (OTLP) telemetry data?
- HTTP Source with OTLP format enabled
- OpenTelemetry Source (Correct answer)
- gRPC Source with OTLP protocol selected
- Metrics Source with OTEL codec
Correct answer: OpenTelemetry Source
Cribl provides a dedicated OpenTelemetry Source that natively handles OTLP data sent over gRPC or HTTP from OpenTelemetry-compatible tools.
Question 5: When configuring an Amazon Kinesis source in Cribl for production use, which AWS credential method is recommended?
- Hardcoded access keys in the source configuration UI
- IAM role assigned to the Cribl instance via instance profile (Correct answer)
- Environment variables set on each worker OS
- A shared credentials file distributed to each worker node
Correct answer: IAM role assigned to the Cribl instance via instance profile
Using an IAM instance profile (role) is recommended because it avoids storing long-lived credentials and automatically rotates short-term access tokens.
Question 6: What does the Dead Letter Queue (DLQ) setting in a Cribl destination do with events that fail after all retry attempts are exhausted?
- Silently drops failed events with no record
- Routes failed events to a designated fallback destination for review (Correct answer)
- Sends an alert and pauses the destination automatically
- Writes failed events back to the originating source queue
Correct answer: Routes failed events to a designated fallback destination for review
The Dead Letter Queue routes events that have exhausted all retry attempts to a fallback destination, preserving them for manual review or alternative processing.
Question 7: When configuring the Cribl Edge File Monitor source, what setting determines how frequently log files are checked for newly written content?
- Flush interval
- Poll interval (Correct answer)
- Scan frequency
- Read buffer size
Correct answer: Poll interval
The poll interval setting defines how often the File Monitor source checks watched files for newly appended content.
Cribl Source & Destination Configuration 5
What is the purpose of the Consumer Group setting when configuring a Kafka source in Cribl?