Examkin

Question

Difficulty: HardConfiguring Cloud Logging, Monitoring, and Operational Alerting

A platform engineering team operates a legacy web application on a fleet of Compute Engine instances. The application writes structured JSON operational logs to a local file at `/var/log/app/service.log`. The team needs to configure automated real-time operational alerts in Cloud Monitoring whenever the frequency of HTTP 5xx server errors parsed from this log file exceeds 50 occurrences within a 1-minute rolling window across the fleet. The solution must follow Google Cloud best practices for observability and operational alerting. Which approach should the team implement?

  1. Install and configure the Google Cloud Ops Agent on the Compute Engine instances to collect and parse the custom log file. Create a Cloud Logging log-based counter metric with a filter matching HTTP 5xx response codes, and configure a Cloud Monitoring alert policy based on the log-based metric threshold exceeding 50 per minute.Answer
  2. B
    Grant the primitive Owner role (`roles/owner`) to the default Compute Engine service account on the project, configure Cloud Audit Logs to track instance file updates, and create a Cloud Monitoring metric threshold alert directly monitoring instance disk write operations.
  3. C
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the application service account, create a Cloud Logging sink that exports all logs to a BigQuery dataset, and schedule a BigQuery SQL query to execute every minute to send email notifications.
  4. D
    Submit a regional quota increase request for Cloud Logging ingestion API quota prior to deployment, configure the instances to stream unparsed raw logs directly to Cloud Storage, and set up a Cloud Monitoring alert policy on the default VM CPU utilization metric.

Answer

Install and configure the Google Cloud Ops Agent on the Compute Engine instances to collect and parse the custom log file, create a Cloud Logging log-based counter metric with a filter matching HTTP 5xx response codes, and configure a Cloud Monitoring alert policy based on the log-based metric threshold exceeding 50 per minute.
The correct approach uses the Ops Agent to collect and parse custom application logs from Compute Engine instances. Creating a Cloud Logging log-based metric extracts a count of HTTP 5xx errors into Cloud Monitoring, where an alert policy can monitor the metric threshold (50 errors per minute) and trigger notifications appropriately.

Step-by-Step Solution

1
Configure log ingestion and parsing with the Ops Agent
Custom application log entries from `/var/log/app/service.log` are ingested into Cloud Logging as structured log payload fields.
Compute Engine instances require the Ops Agent to read local custom log files and parse structured log fields such as HTTP status codes.
2
Create a Cloud Logging log-based counter metric
A numerical time-series metric is generated based on the frequency of log entries matching HTTP status code ≥500\geq 500.
Log-based metrics extract numerical data from log entries, allowing Cloud Monitoring to evaluate threshold conditions over time.
3
Set up a Cloud Monitoring alert policy
An alert is triggered automatically whenever the log-based metric count exceeds 50 within a 1-minute window.
Cloud Monitoring alert policies continuously evaluate metric time-series against defined thresholds and send notifications when breached.

Key Concept

Configuring Cloud Logging log-based metrics and Cloud Monitoring alert policies for custom application logs
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting