Monitoring, observability, troubleshooting, and maintenance
Domain 4 tests how you find out what is wrong, which telemetry layer to consult, and which maintenance actions are safe. Stems usually present a symptom and expect you to name the first diagnostic step and the correct owner of the fix.
Telemetry layers
Cloudera Manager runs per cluster and reports service and role health, health tests, charts, alerts, role logs, and diagnostic bundles. Cloudera Observability works across clusters from the control plane, with workload and query analysis, cost and chargeback views, and alerting. Cloud provider monitoring supplies infrastructure metrics, billing, and network flow data. The control plane shows environment and cluster status and API events.
Troubleshooting path
Classify the failure layer first. Provisioning failures point to credential trust, subnet or AZ capacity, service quotas, or missing gateway endpoints. A service that will not start points to a Cloudera Manager health test and role logs. An AccessDenied on object storage requires separating authorization from identity: a Ranger Raz denial appears in Ranger audit, while a 403 with no Ranger record points to the IDBroker-assumed role, its trust policy, or the bucket policy. Slow queries are diagnosed through Observability query details, the Impala query profile, and admission control settings.
Maintenance
Data Hub runtime upgrades roll parcels and restart roles within a window. Data Lake upgrades are performed by Cloudera, not self-service. Rotate cloud credentials and review idle clusters regularly; capture a diagnostic bundle before deleting a cluster, because node logs disappear while the logs bucket retains what was shipped. Recipes apply only at bootstrap, so patching one means rebuilding the cluster.
Worked example
Spark jobs begin failing with 403 on S3 immediately after an IAM policy edit. Reasoning: nodes never hold static keys, so check the cross-account role permissions and its trust relationship with IDBroker, then the bucket policy. Confirm in Ranger audit whether any denial was recorded; absence of a Ranger record combined with a 403 implicates IAM, not Ranger. Check Cloudera Manager role logs for the exact error before changing anything.
Traps
Watching only cloud CPU metrics for a data-access failure; expecting node logs to survive cluster deletion; restarting Data Lake services without Cloudera involvement; treating Observability and Cloudera Manager as interchangeable; skipping health tests and guessing from charts.