2 Monitoring and Alerting Free Online FlashCards

Why should teams set monitoring goals before choosing metrics?

Define operational goals first, such as detecting user-visible failures, finding capacity risks, supporting incident diagnosis, or checking service objectives.

How do black-box and white-box monitoring differ?

Black-box monitoring tests the service as users experience it; white-box monitoring measures internal components to help locate causes.

What are the four golden signals for a user-facing service?

The four golden signals are latency, traffic, errors, and saturation, which indicates how close a system is to its capacity.

Why track latency percentiles instead of only averages?

Latency percentiles reveal slow experiences for some users; averages can hide those delays.

What makes logs easier to search and correlate?

Logs are timestamped event records. Structured fields such as time, severity, service, and request or trace identifier make them easier to search and correlate.

What do traces reveal in a distributed system?

A trace shows a request's path across services and helps identify where time is spent or errors arise.

Why correlate metrics, logs, and traces?

Correlating metrics, logs, and traces provides a more complete view of system behavior than relying on any one signal.

What is a dashboard's role during incident response?

A dashboard makes service health understandable at a glance and helps responders move from a symptom toward likely causes.

What makes a notification a useful alert?

An alert is a notification that requires a person to act. It should address an urgent problem, affect users or soon do so, and enable a specific response.

Why prefer sustained service impact over a brief CPU spike?

Prefer alerting on sustained user-impacting checkout errors or latency rather than paging for one server's brief CPU spike.

How should urgent and non-urgent alerts be routed?

Page responders for urgent, actionable problems; route important but non-urgent work to a ticket or review dashboard.

How can evaluation windows reduce alert noise?

Use suitable evaluation windows or persistence conditions so brief blips can recover without repeatedly interrupting responders.