SRE Observability & Logging 2 — Questions and Answers
Question 1: Which log severity level should be used for events that indicate the system is in an unrecoverable state and will shut down?
- WARN
- ERROR
- CRITICAL/FATAL (Correct answer)
- INFO
Correct answer: CRITICAL/FATAL
CRITICAL or FATAL severity indicates an unrecoverable condition that forces the application to abort or shut down.
Question 2: In distributed tracing, what does a 'span' represent?
- A single log line emitted by a service
- A named, timed operation within a trace representing a unit of work (Correct answer)
- The entire end-to-end journey of a request
- A metric sample collected at a point in time
Correct answer: A named, timed operation within a trace representing a unit of work
A span is a named, timed operation that represents a single unit of work within a distributed trace.
Question 3: What is the primary purpose of a log aggregation pipeline in an SRE context?
- To compress logs to save disk space
- To centralize logs from multiple sources for unified search and analysis (Correct answer)
- To delete logs older than 30 days automatically
- To convert structured logs into unstructured text
Correct answer: To centralize logs from multiple sources for unified search and analysis
Log aggregation centralizes logs from many services into a single platform, enabling unified querying and correlation.
Question 4: Which OpenTelemetry signal type is used to capture request duration across microservices?
- Logs
- Metrics
- Traces (Correct answer)
- Events
Correct answer: Traces
Traces capture timing and causality across microservice calls, making them ideal for measuring request duration end-to-end.
Question 5: An SRE notices log volume spikes correlate with increased latency. Which observability practice best helps confirm a causal relationship?
- Increasing log retention period
- Correlating trace IDs with log entries during the spike window (Correct answer)
- Switching to asynchronous logging
- Reducing log verbosity to ERROR only
Correct answer: Correlating trace IDs with log entries during the spike window
Correlating trace IDs with logs during the spike allows you to follow specific requests and confirm whether log contention or logged errors cause latency.
Question 6: What does 'cardinality' mean in the context of metrics and observability?
- The frequency at which metrics are sampled
- The number of unique label/tag value combinations for a metric (Correct answer)
- The retention period for time-series data
- The compression ratio of stored metrics
Correct answer: The number of unique label/tag value combinations for a metric
Cardinality refers to the number of unique combinations of label values, and high cardinality can strain time-series databases.
Question 7: In the context of SRE observability, what is 'exemplars'?
- Sample log messages used as templates
- Representative trace IDs embedded in metric data points to link metrics to traces (Correct answer)
- Golden signals chosen as KPIs for a service
- Canonical alert definitions used across teams
Correct answer: Representative trace IDs embedded in metric data points to link metrics to traces
Exemplars are specific trace IDs or request identifiers attached to metric data points, enabling direct navigation from a metric spike to a specific trace.
SRE Observability & Logging 2
Which log severity level should be used for events that indicate the system is in an unrecoverable state and will shut down?