Question

Difficulty: MediumMonitoring and Logging

A cloud administrator needs to track specific HTTP 500 error patterns contained within application log entries and receive automated notifications whenever the error frequency exceeds a set threshold within a 5-minute window. Which TWO actions should the administrator perform in Google Cloud Observability to meet these requirements?

  1. Create a counter log-based metric in Cloud Logging using a log filter matching the HTTP 500 error entries.Answer
  2. Create an alerting policy in Cloud Monitoring that monitors the counter log-based metric and defines the threshold condition.Answer
  3. C
    Enable the Google Cloud Observability API inside the Billing Account settings page rather than within the workload's Google Cloud project.
  4. D
    Grant the primitive Owner role to the logging service account at the resource level, assuming it overrides any inherited restrictive IAM permissions from parent folders.

Answer

To track log patterns and receive alerts based on log occurrence frequency, the administrator must create a counter log-based metric in Cloud Logging filtered for the HTTP 500 errors and configure a Cloud Monitoring alerting policy that monitors this new metric.
Creating a counter log-based metric allows Cloud Logging to aggregate log occurrences matching a specific filter into a numeric time-series metric. Setting up an alerting policy in Cloud Monitoring based on this metric ensures that notifications are sent when the metric exceeds the defined rate threshold.

Step-by-Step Solution

1
Define a counter log-based metric in Cloud Logging
Cloud Logging converts incoming log entries matching the filter (HTTP 500 errors) into a time-series metric readable by Cloud Monitoring.
Standard metrics do not track custom application log patterns automatically; a log-based metric bridges log data into Cloud Monitoring.
2
Configure a Cloud Monitoring alerting policy
An alerting policy continuously evaluates the log-based metric rate against the specified threshold (e.g., 10 occurrences per 5 minutes) and triggers configured notification channels upon breach.
Alerting policies evaluate time-series metrics to generate incident alerts and notify operations teams.

Key Concept

Log-based Metrics and Cloud Monitoring Alerting Policies
Estimated Time:1m 30s
Rate this question