Monitoring, Observability, and Alerting
What the exam tests
This domain tests how you instrument IBM Cloud workloads, distinguish monitoring from observability, and build alerts that reflect user impact. Expect metrics, logs, traces, events, golden signals, RED and USE methods, IBM Cloud Monitoring, IBM Cloud Logs, Activity Tracker, and VPC flow logs.
Core rules
- Metrics show trends and saturation, logs provide event detail, traces show request paths across services, and audit events show who changed what.
- For services, use the golden signals: latency, traffic, errors, and saturation. RED (rate, errors, duration) fits request-driven services; USE (utilization, saturation, errors) fits resources.
- Alert on symptoms that affect users, such as SLO burn or elevated 5xx rate. Use cause signals such as CPU or disk for dashboards and tickets.
- Every page needs an owner, severity, runbook link, and clear action. Multi-window burn alerts reduce noise.
- IBM Cloud Monitoring collects platform and agent metrics. On Kubernetes, verify the agent is installed and scraping the right namespace.
- IBM Cloud Logs supports search and retention policies. Activity Tracker records account-level audit events. VPC flow logs capture accepted and rejected network traffic.
Worked example. A Kubernetes pod reports 95% CPU for 10 minutes, but users see no errors. A static CPU alert pages on-call at 3 a.m. A better design pages when the 5xx rate consumes 2% of the 30-day error budget in one hour, and opens a ticket for sustained CPU above 90%. Reasoning: CPU is a saturation cause; error-budget burn is the user-facing symptom. Keep CPU for capacity planning, not primary paging.
Traps that cost marks
Alerting on every pod restart; using high-cardinality labels such as request ID in metrics; assuming logs are a substitute for metrics; missing agent deployment; no runbook; static thresholds that ignore traffic patterns; retaining audit logs without reviewing them.
Key points
- Metrics, logs, traces, and audit events answer different questions.
- Golden signals and RED/USE guide instrument selection.
- Page on user-facing symptoms; ticket on cause signals.
- Multi-window SLO burn reduces alert fatigue.
- Confirm IBM Cloud Monitoring agents and log sources are actually reporting.