Kubernetes Container Orchestration Monitoring and Logging 5 — Questions and Answers
Question 1: What is the primary advantage of using structured logging (JSON format) in Kubernetes applications?
- Logs can be easily parsed and filtered by log aggregation tools (Correct answer)
- Logs take less disk space
- Logs are automatically encrypted
- Structured logs bypass the container runtime
Correct answer: Logs can be easily parsed and filtered by log aggregation tools
Structured JSON logs can be parsed, indexed, and queried by tools like Elasticsearch and Loki, enabling powerful filtering and analysis.
Question 2: Which Alertmanager concept groups related alerts together to reduce notification noise?
- Grouping (Correct answer)
- Inhibition
- Silencing
- Routing
Correct answer: Grouping
Alertmanager's grouping feature batches alerts sharing common labels into a single notification, reducing alert fatigue during incidents.
Question 3: What does the Prometheus `irate()` function calculate differently from `rate()`?
- Instantaneous rate using only the last two data points (Correct answer)
- Integrated rate over the full time range
- Rate including resets in the counter
- Rate normalized to per-minute instead of per-second
Correct answer: Instantaneous rate using only the last two data points
`irate()` calculates the instantaneous per-second rate using only the last two data points, making it more responsive to spikes than `rate()`.
Question 4: In Loki's LogQL query language, what does a stream selector like `{app="nginx"}` do?
- Filters log streams to only those with the label app=nginx (Correct answer)
- Searches log content for the string 'nginx'
- Selects pods named nginx for resource metrics
- Creates an alert when nginx logs appear
Correct answer: Filters log streams to only those with the label app=nginx
Stream selectors in LogQL use label matchers to filter which log streams (defined by their label sets) are included in the query.
Question 5: What happens to pod logs in Kubernetes when a node is deleted or fails?
- Logs stored only on that node are permanently lost unless forwarded externally (Correct answer)
- Logs are automatically replicated to other nodes
- The control plane preserves logs in etcd
- Logs are moved to the replacement node
Correct answer: Logs stored only on that node are permanently lost unless forwarded externally
Kubernetes only stores logs on the node where the container ran; if the node is lost without an external log forwarder, those logs are gone.
Question 6: Which Prometheus metric type is best suited for measuring request latency with quantile calculations?
- Histogram (Correct answer)
- Gauge
- Counter
- Summary
Correct answer: Histogram
Histograms bucket observations into configurable ranges and allow server-side quantile calculation via `histogram_quantile()` in PromQL.
Question 7: What does the `--since` flag in `kubectl logs` allow you to do?
- Retrieve logs only from a relative time duration in the past (Correct answer)
- Filter logs by a specific timestamp
- Show logs since the pod last restarted
- Display logs from a specific date range
Correct answer: Retrieve logs only from a relative time duration in the past
The `--since` flag accepts a duration (e.g., `--since=1h`) and returns only log lines generated within that time window relative to now.
Kubernetes Container Orchestration Monitoring and Logging 5
What is the primary advantage of using structured logging (JSON format) in Kubernetes applications?