Observability Concepts
Observability Concepts
This domain tests how you reason about telemetry rather than how you type queries: the three pillars of metrics, logs, and traces; monitoring versus observability; SLIs, SLOs, and SLAs; and the operational cost of labels and cardinality. Expect questions that ask which signal answers a question or which design choice creates a production problem.
Core rules
- Metrics are aggregated numeric time series; logs are discrete events; traces follow a request across services. Use metrics for trends and alerting, traces for latency attribution, and logs for detail.
- An SLI is a measured ratio; an SLO is a target for that SLI; an SLA is a contract with consequences.
- Observability is the ability to ask new questions without shipping new code; monitoring checks known failure modes.
- Every unique label combination creates a time series. User IDs, request IDs, and raw URLs in labels cause cardinality explosions.
Worked example
An SLO is 99.9% availability over a 30-day window. Total minutes = 30 x 24 x 60 = 43,200. The error budget is 0.1% = 43.2 minutes. If the service has already been unavailable for 30 minutes, only 13.2 minutes remain. Reasoning: convert the percentage to a fraction of the window, then subtract observed bad minutes. This is why burn-rate alerts often use a short and a long window together.
Traps
Confusing an SLA with an SLO; calling dashboards observability without traces or logs; putting unbounded values in labels; assuming more metrics always means better insight.