Examkin

Question

Difficulty: HardMonitoring and Logging

An application deployed on Google Cloud outputs structured JSON logs to Cloud Logging. An Operations SRE must configure an automated real-time notification whenever the system generates more than 50 HTTP 500 error responses within a 5-minute rolling window. Which approach follows Google Cloud recommended practices to achieve this objective?

  1. Create a custom log-based counter metric in Cloud Logging using a filter for HTTP status code 500, and then create a Cloud Monitoring alerting policy based on that metric.Answer
  2. B
    Deploy the legacy Stackdriver Logging agent to parse raw container logs into standard system metrics, and attach a built-in threshold alert.
  3. C
    Grant the primitive Owner role to the Cloud Logging service account in the project IAM settings so it can automatically dispatch alert notifications.
  4. D
    Enable the Cloud Logging API at the organization level and revoke the Logs Viewer role at the project level to force alert triggers.

Answer

The correct approach is to create a custom log-based counter metric in Cloud Logging filtered for HTTP status code 500, and configure a Cloud Monitoring alerting policy conditioned on this metric.
Log-based metrics bridge Cloud Logging and Cloud Monitoring by turning log data matching a specific query filter (such as HTTP status code 500) into numerical metric time series. SREs can then attach standard Cloud Monitoring alerting policies to these metrics to trigger notifications when thresholds are breached.

Step-by-Step Solution

1
Define a filter query in Cloud Logging for HTTP 500 errors
Identifies structured log records where `httpRequest.status = 500` or equivalent payload fields match the error pattern.
Filtering isolate specific events needed to track error frequency.
2
Create a log-based counter metric
Translates log entries matching the filter into a numerical time series metric in Cloud Monitoring.
Cloud Monitoring requires time series metric data to evaluate threshold conditions over time windows.
3
Configure a Cloud Monitoring Alerting Policy
Triggers alert notifications when the log-based metric exceeds 50 counts over the 5-minute aggregation window.
Completes the operational requirement for automated real-time incident alerting.

Key Concept

Custom Log-based Metrics and Alerting Policies
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Logging

More questions from this topic