Managing logs
A log's chain from emission to search, syslog and its eight levels, structured logs, UTC time, the correlation id, rotation, retention and the personal data not to write.
- 27 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- The numbers
- Scenarios
A few cards from the deck
Log aggregation: what is it?
Show the answer
Gathering in one place, indexed and searchable, the logs of all machines and all services.
Without it, understanding a failure means logging into machine after machine, and a log disappears with the instance destroyed by scaling.
Which of these syslog levels is the most serious?
- alert
- critical
- error
- warning
Show the answer
alert
The eight levels run 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 info, 7 debug: the smaller the number, the more serious. So alert (1) comes before critical (2), against intuition.
A log follows a chain: the application … it, an agent … it, it is transported, then … so it can be ….
Show the answer
A log follows a chain: the application emits it, an agent collects it, it is transported, then indexed so it can be searched.
A buffer queue between collection and indexing absorbs bursts: without it, a slow indexer would lose lines.
Syslog: what is it?
Show the answer
A standard protocol and format for log messages, which classifies each message by origin and by severity level from 0 to 7.
The eight levels go from 0 emergency to 7 debug: the smaller the number, the more serious. Filtering is often done from one level up, for example warning and above.