Monitoring, Alerting and Logging
CloudMonitor collects metrics (CPU, memory via agent, disk, network) and supports alarm rules with thresholds, silence periods, and notification contacts. A candidate must know that some metrics (like memory and process) require the CloudMonitor agent, while host-level metrics are available by default. Alarm rules can trigger actions such as auto scaling or sending messages to MNS/notifications.
Log Service (SLS) ingests logs via Logtail or SDK, stores them in Logstores within a Project, and supports queries, dashboards, and alerts. Understand the difference between collecting (Logtail), indexing (needed for search), and alerting. Application Real-time Monitoring Service (ARMS) covers APM.
Traps: assuming memory alarms work without the agent; forgetting that a logstore must be indexed before queries return results; confusing metric alarms with event alarms; assuming alarm silence suppresses the underlying issue (it only suppresses notifications). Also, notification contacts must be configured and verified, or alarms fire silently.
Rule of thumb: for "no alarm fired though the issue occurred," check: is the metric collected (agent installed)? Is the rule enabled and threshold correct? Are notification contacts configured and verified?
Worked example: CPU alarm works but memory alarm never triggers - the CloudMonitor agent is not installed, so memory metrics are absent.