Examkin

Question

Difficulty: Very hardMonitoring, Logging, and Observability Integration

An organization manages a fleet of 500 Compute Engine virtual machines hosting a latency-sensitive trading platform across multiple Google Cloud projects. The infrastructure engineering team implemented a unified log exclusion filter at the organization level (`resource.type="gce_instance" AND severity<ERROR`) on an aggregate Log Router sink to reduce Cloud Logging storage ingestion overhead. Shortly after applying this filter, automated incident response alerts stopped triggering for VM crash loops and system failures caused by memory exhaustion, even though the application services were uncommunicative. Upon investigation, engineers noticed that critical Linux kernel panic logs and systemd process failure events emitted by the OS were missing from their Monitoring dashboards and BigQuery security audit datasets. Which architectural modification should the team implement to restore operational visibility and automated incident alerting while retaining log storage cost control?

  1. A
    Remove the organization-level exclusion filter and configure non-billable Log Router exclusion rules specifically at the project bucket level using log analytics sinks while routing system metrics via Cloud Monitoring.
  2. Modify the organization log exclusion filter to explicitly exclude log messages only matching `severity<WARNING AND NOT logName:"logs/systemd" AND NOT logName:"logs/syslog"`, ensuring high-priority system daemon events bypass exclusion filters.Answer
  3. C
    Grant `roles/logging.admin` to the Compute Engine default service account across all instances and deploy the Ops Agent configured with default syslog stream settings.
  4. D
    Create an additional organization-level sink pointing directly to a Cloud Pub/Sub topic using `severity>=INFO` while keeping the original exclusion filter on the default `_Default` bucket sink unchanged.

Answer

Refine the organization-level Log Router exclusion filter to preserve essential OS system logs (syslog and systemd) by excluding low-severity logs while explicitly retaining critical operational streams below ERROR severity.
The correct solution modifies the Log Router exclusion filter so that essential OS log streams (such as systemd daemons and system syslog events) are explicitly exempted from being discarded when filtering entries below ERROR severity. This restores automated alerting and observability while still excluding non-essential low-severity logs from compute instances.

Step-by-Step Solution

1
Analyze the impact of the current exclusion filter (`severity<ERROR`).
Identified that critical operational events (such as systemd process crashes or kernel driver messages) are frequently logged under INFO, NOTICE, or WARNING severities, causing them to be dropped before reaching storage or alerting mechanisms.
Exclusion filters drop log entries matching the filter criteria at the Cloud Logging router prior to routing to sinks.
2
Evaluate the target requirement for cost optimization versus observability integrity.
Determined that system logs (`logs/syslog` and `logs/systemd`) must be explicitly protected from exclusion using Boolean logical clauses in the Log Router filter.
Observability integration requires maintaining high-cardinality signal visibility for OS lifecycle events without ingesting non-essential debug noise.
3
Select the log router filter configuration that selectively preserves vital daemon streams.
Refining the exclusion query to prevent matching essential log streams ensures that system-level crash indicators remain accessible for Cloud Monitoring alerts and BigQuery auditing.
Log Router inclusion/exclusion expressions directly control ingestion policies across all downstream sinks.

Key Concept

Cloud Logging Router Exclusion Filters and System Observability Integration
Estimated Time:3m 0s
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic