Latency for an endpoint suddenly spiked. How do you use observability to find the cause?
What they are really testing: Whether you investigate methodically using the three pillars together, symptom in metrics, location in traces, cause in logs, rather than guessing or grepping randomly.
A real interview question
Latency for an endpoint suddenly spiked. How do you use observability to find the cause?
What most people say
drag me
“I would look at the logs to see what is going wrong.”
Jumping straight to grepping logs without first scoping the symptom in metrics and localizing with traces is slow and unfocused. The three pillars work together: metrics for what/when, traces for where, logs for why.
The follow-ups they ask next
Why not just start with the logs?
Without first scoping the symptom (metrics) and localizing the slow service/span (traces), you are grepping huge log volumes blind. Metrics and traces narrow you to the right service and time window so the logs you read are the relevant ones.
What is the fastest single correlation to check on a sudden spike?
Whether it started at a deploy or config change. Lining the spike up against the change timeline very often points straight at the cause; if so, consider rolling back while you investigate.
What the interviewer is listening for
- Uses metrics->traces->logs in order
- Correlates with deploys/saturation
- Localizes with traces before reading logs
What sinks the answer
- Greps logs blindly first
- No correlation with changes
- Does not use traces to localize
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I use the pillars together: [metrics first, scope the symptom, which endpoint, when, p95/p99, errors or latency]. [Correlate with deploys/traffic/saturation, a spike at a deploy is a strong lead]. [Traces to localize which service/span is slow]. [Logs (filtered by trace/correlation ID) for the why]. Metrics = what/when, traces = where, logs = why, far faster than grepping blind.”
Keep going with observability
Foundation
What is the difference between monitoring and observability?
Foundation
What are the three pillars of observability, and what is each good for?
Foundation
What should you measure first for a service? Explain the golden signals (or RED/USE).
Junior
What are good logging practices for a distributed system?
Junior
What are the main metric types (counter, gauge, histogram), and when do you use each?
Junior
What is distributed tracing, and how does it work?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free