Examkin

Question

Difficulty: EasyMonitoring, Logging, and Observability Integration

An operations team is tasked with reducing Cloud Logging ingestion costs for a fleet of Compute Engine instances running production workloads. To reduce log volume, an administrator created an exclusion filter on the `_Default` log sink using the expression `resource.type="gce_instance"`. Shortly after, the operational alerting system failed to trigger alerts during an application outage. Which architectural misconfiguration caused the missing alerts?

  1. The exclusion filter broadly matches all Compute Engine log entries, discarding high-severity error logs before ingestion and preventing Cloud Monitoring from evaluating alerting metrics.Answer
  2. B
    The exclusion filter only affects debug logs, but Cloud Monitoring automatically disables alerting policies whenever any log exclusion rule is active.
  3. C
    The Log Router service account was granted primitive Owner permissions instead of Monitoring Admin permissions, disabling log evaluation.
  4. D
    The exclusion filter failed because VPC Service Controls blocked log traffic from leaving the virtual private cloud perimeter.

Answer

The exclusion filter broadly matches all Compute Engine log entries, discarding high-severity error logs before ingestion and preventing Cloud Monitoring from evaluating alerting metrics.
The correct solution correctly identifies that an exclusion filter specifying `resource.type="gce_instance"` matches every log emitted by GCE instances. Because Log Router exclusion filters drop matching logs before ingestion, all error and crash logs are discarded, preventing Cloud Monitoring from detecting incidents or triggering alerting policies.

Step-by-Step Solution

1
Analyze the log exclusion filter expression used by the administrator.
The expression `resource.type="gce_instance"` selects all log entries emitted by Compute Engine instances regardless of log level or severity.
Log Router exclusion filters prevent matching entries from being ingested into the destination bucket.
2
Determine the impact of dropping matching logs at the Log Router level.
High-severity application errors, system crashes, and audit events are discarded before reaching Cloud Logging storage or metric evaluation engines.
Cloud Monitoring alerting policies relying on log-based metrics or log ingestion cannot trigger if the underlying log records are excluded.
3
Identify the proper observability design pattern.
Exclusion filters should specify non-critical log levels (such as severity < NOTICE or DEBUG logs) rather than filtering entire resource types.
This preserves critical operational visibility and alerting capabilities while optimizing ingestion costs.

Key Concept

Cloud Logging Exclusion Filters and Log Router Ingestion
Estimated Time:1m 0s
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic