Observability & Logging Flashcards

Which log severity level should be used for events that indicate the system is in an unrecoverable state and will shut down?

Answer: CRITICAL/FATAL

CRITICAL or FATAL severity indicates an unrecoverable condition that forces the application to abort or shut down.

In distributed tracing, what does a 'span' represent?

Answer: A named, timed operation within a trace representing a unit of work

A span is a named, timed operation that represents a single unit of work within a distributed trace.

What is the primary purpose of a log aggregation pipeline in an SRE context?

Answer: To centralize logs from multiple sources for unified search and analysis

Log aggregation centralizes logs from many services into a single platform, enabling unified querying and correlation.

Which OpenTelemetry signal type is used to capture request duration across microservices?

Answer: Traces

Traces capture timing and causality across microservice calls, making them ideal for measuring request duration end-to-end.

An SRE notices log volume spikes correlate with increased latency. Which observability practice best helps confirm a causal relationship?

Answer: Correlating trace IDs with log entries during the spike window

Correlating trace IDs with logs during the spike allows you to follow specific requests and confirm whether log contention or logged errors cause latency.

What does 'cardinality' mean in the context of metrics and observability?

Answer: The number of unique label/tag value combinations for a metric

Cardinality refers to the number of unique combinations of label values, and high cardinality can strain time-series databases.

In the context of SRE observability, what is 'exemplars'?

Answer: Representative trace IDs embedded in metric data points to link metrics to traces

Exemplars are specific trace IDs or request identifiers attached to metric data points, enabling direct navigation from a metric spike to a specific trace.