SRE Observability & Logging 5 — Questions and Answers
Question 1: What is 'synthetic monitoring' in the context of SRE observability?
- Generating fake metrics to test alerting pipelines
- Simulating user transactions against production or staging to proactively detect availability issues (Correct answer)
- Using ML models to predict future metric values
- Anonymizing real user data for testing purposes
Correct answer: Simulating user transactions against production or staging to proactively detect availability issues
Synthetic monitoring uses scripted probes or transactions to continuously test service availability and performance from an external perspective.
Question 2: Which logging anti-pattern causes the most problems during high-severity incidents?
- Using structured JSON format
- Logging at DEBUG level in production, causing I/O saturation under load (Correct answer)
- Including timestamps in every log line
- Using a centralized log aggregation system
Correct answer: Logging at DEBUG level in production, causing I/O saturation under load
Verbose DEBUG logging in production can saturate disk I/O and CPU under load, worsening incidents while making logs harder to search.
Question 3: In SRE, what is the purpose of 'USE method' metrics?
- Tracking User, Session, and Event counts for application analytics
- Measuring Utilization, Saturation, and Errors for every resource in the system (Correct answer)
- Monitoring URL, Status, and Elapsed time for HTTP endpoints
- Alerting on Uptime, SLA, and Efficiency metrics
Correct answer: Measuring Utilization, Saturation, and Errors for every resource in the system
The USE method (Utilization, Saturation, Errors) is a framework for analyzing resource bottlenecks at the infrastructure layer.
Question 4: What is a 'dead man's switch' alert in SRE observability?
- An alert that fires when CPU utilization reaches 100%
- An alert that fires when a heartbeat or watchdog signal stops being received, indicating a silent failure (Correct answer)
- An alert triggered by log parsing errors in the aggregation pipeline
- An alert that automatically pages the on-call engineer after 30 minutes of silence
Correct answer: An alert that fires when a heartbeat or watchdog signal stops being received, indicating a silent failure
A dead man's switch alert fires when an expected periodic signal (heartbeat) is absent, detecting silent failures where nothing is logged.
Question 5: Which of the following is a key advantage of using a centralized tracing backend like Jaeger or Zipkin?
- It eliminates the need for application-level instrumentation
- It provides a UI to visualize end-to-end request flows and identify latency bottlenecks across services (Correct answer)
- It automatically correlates traces with infrastructure metrics
- It replaces the need for log aggregation platforms
Correct answer: It provides a UI to visualize end-to-end request flows and identify latency bottlenecks across services
Centralized tracing backends store and visualize span data, enabling SREs to see the full request path and identify which service contributes most latency.
Question 6: When building an observability strategy for a new microservice, which action should an SRE prioritize first?
- Setting up dashboards in Grafana before deploying the service
- Defining SLIs and ensuring the service emits the metrics needed to measure them (Correct answer)
- Configuring 100% trace sampling to capture all requests
- Creating alerts for every possible error condition
Correct answer: Defining SLIs and ensuring the service emits the metrics needed to measure them
SLIs define what matters to users, so instrumenting those signals first ensures observability is aligned with reliability goals from day one.
Question 7: A team uses Elasticsearch, Logstash, and Kibana (ELK stack). What is Logstash's role?
- Storing and indexing log data for search
- Ingesting, transforming, and shipping log data to Elasticsearch (Correct answer)
- Providing the visualization and dashboarding interface
- Collecting metrics from application endpoints via scraping
Correct answer: Ingesting, transforming, and shipping log data to Elasticsearch
Logstash is the data processing pipeline that ingests logs from various sources, applies filters and transformations, and forwards them to Elasticsearch.
SRE Observability & Logging 5
What is 'synthetic monitoring' in the context of SRE observability?