DevOps · Guide

Observability

Centralised logging, distributed tracing and alerting — the three things that turn “it is slow” into a cause.

— min read DevOps

Monitoring Answers Known Questions

Monitoring tells you that something is wrong, against questions you thought of in advance. Observability is whether you can answer a question you did not anticipate, without shipping new code.

Three signals, and they do different jobs. Metrics are cheap numbers over time — good for dashboards and alerts, bad at explaining a single request. Logs are detailed events — good for explaining, expensive at volume. Traces follow one request across services — the only one that answers "where did the time go".

SignalAnswersCost
MetricsIs it happening, how often, how badCheap, aggregated
LogsWhat exactly happened hereExpensive at volume
TracesWhere the latency went across servicesSampled, needs instrumenting

The usual path is metrics to notice, traces to locate, logs to explain. A team with only logs will find things eventually and expensively; one with only metrics will know something is wrong and not why.

Centralised Logging

Logs on a machine are useless the moment you have more than one machine, or a container that has already exited. Ship them somewhere central and searchable.

Log structured, as key-value or JSON, not prose. A line reading "user 42 failed login from 1.2.3.4" cannot be aggregated; the same event with fields can be counted, grouped and alerted on.

Unsearchable, then searchable
# prose: greppable at best, never aggregatable
"Failed login for user 42 from 1.2.3.4 after 3 tries"

# structured: countable, groupable, alertable
{ "event": "login_failed",
  "user_id": 42,
  "source_ip": "1.2.3.4",
  "attempts": 3,
  "trace_id": "a1b2c3" }   # ties this line to the trace
RuleWhy
One event per lineMulti-line entries break every parser
Include a trace idJoins the log to the request it belongs to
Use levels honestlyIf everything is ERROR, nothing is
Never log secrets or personal dataLogs are widely readable and retained
Set retention deliberatelyStorage is the entire cost of logging
Logs are the easiest place to leak data. Tokens in a request dump, passwords in a failed-payload log, personal data in an error — all of it ends up in a searchable store many people can read, and retained far longer than anyone intended.

Distributed Tracing

One user request crossing six services produces six sets of logs with no obvious relationship. A trace stitches them into one timeline.

A trace is the whole request; a span is one unit of work within it, with a duration and a parent. Nested spans reveal where the time actually went — usually somewhere nobody suspected.

ConceptIs
Trace idFollows the request everywhere it goes
SpanOne operation, timed, with a parent
Context propagationPassing the ids across service boundaries
SamplingKeeping a fraction, because all of it is too much
Propagation is where tracing usually breaks. One service that does not forward the headers ends the trace there, and everything downstream becomes invisible — with no error to tell you.

Sample intelligently: a small share of successful requests is plenty, but keep everything that errored or ran slowly. Those are the traces you will actually open.

Alerting

An alert is a claim that a human must act now. If that is not true, it is not an alert — it is a dashboard, or a ticket.

Alert on symptoms, not causes. "Error rate above 2% for five minutes" matters whatever caused it. "CPU above 80%" may be perfectly healthy, and firing on it teaches people that pages are usually noise.

PageDo not page
Users are seeing errorsA single pod restarted
Latency breached the objectiveCPU is briefly high
Error budget burning fastDisk at 60%
A queue is growing without boundA deploy finished
Alert fatigue is the failure mode. Every page nobody acted on makes the next one likelier to be ignored — including the real one. Delete or downgrade any alert that has not led to action; a quiet pager is the goal, not a suspicious sign.

Use burn rate where you have an SLO: alert when the error budget is being consumed fast enough to run out early. It fires for real problems and stays quiet for brief blips, which fixed thresholds cannot do.

Interview Questions

Monitoring versus observability?

Monitoring answers questions you defined in advance — dashboards and alerts for known failure modes. Observability is whether you can answer a new question from existing data, without shipping code. Metrics monitor; traces and structured logs give observability.

Why structured logs?

Prose can only be grepped. Structured events can be counted, grouped, filtered and alerted on, and can carry a trace id linking them to the request they came from.

What is a span?

One timed operation within a trace, with a parent. Nesting them shows where the latency went across services — which no single service's logs can tell you.

Symptoms or causes — what do you alert on?

Symptoms. Users care about errors and slowness, not CPU. Cause-based alerts fire when nothing is wrong and train people to ignore the pager.

What is burn-rate alerting?

Alerting on how fast the error budget is being consumed rather than on a fixed threshold. Fast burn pages immediately; slow burn raises a ticket. It ignores brief blips that no fixed threshold can distinguish.

Why is tracing often incomplete?

Context propagation. Every service must forward the trace headers; one that does not silently truncates the trace, and everything downstream disappears with no error.

Quick Quiz

1. Which signal tells you where latency went across services?
2. You should alert on…
3. A trace ends unexpectedly mid-request. Most likely…
4. Structured logging exists mainly so logs can be…
5. An alert nobody has ever acted on should be…