46After a reboot the journal is empty. How does journald decide what to keep, and how do you fix retention?▼easyTCSInfosysRed Hat◆ premiumVolatile by default on many distros, size-capped by silent policy, binary on disk. Know the storage modes, the vacuum knobs, and how journald feeds central logging.Open full answer →
28You need one log collector on every node, including nodes that join later. Which workload object do you reach for?▼easyDatadogRed HatAmazon & AWS○ sign inExplain per-node eligibility and update behaviour, then verify that a Ready collector is actually delivering logs.Open full answer →
03ELK, Splunk, or a managed platform like Datadog: how would you choose a logging stack?▼easyNewSplunkDatadogAccentureunlockedAll three can search logs. What differs is who operates the cluster and how the bill is shaped, and the bill is what kills these projects, not the querying.Open full answer →
10Logging costs more than the database and leadership wants the bill halved without losing signal. Design the pipeline.▼hardDatadogSnowflakeCloudflareunlockedThe instinct is to delete old logs. That is backwards: the waste lives in what you ingest, not how long you keep it. This answer walks the levers in the order that actually pays.Open full answer →
16Follow one log line from the application into Elasticsearch and onto the Kibana screen. Where does this path break at scale?▼mediumAmazon & AWSFlipkartJPMorgan ChaseunlockedThe data-path question separates people who have sized a cluster from people who installed one. Shard sizing, refresh versus flush, and each ILM phase carry one specific failure mode apiece.Open full answer →
35We can't afford full logging on our hottest service. Sample the logs or filter aggressively, and what do we lose?▼mediumRazorpaySwiggyDatadog◆ premiumSampling keeps proportions and loses rare individuals; filtering keeps chosen classes complete and loses whatever you misclassified. Decide retention at write time, keep counters always, rehydrate the rest.Open full answer →
02You are on a Linux box you have never seen and something is failing. Where are the logs?▼easyNewRed HatIBMTCSunlockedThree places, and which one depends on how the thing was started. Knowing which logs the runtime collects and which the application writes itself, and that journald may not persist across reboots, saves the first twenty minutes.Open full answer →
28Apps emit more log lines than the logging pipeline stores, and nothing alerts. Where do the missing events go?▼mediumWalmart Global TechDatadogSnowflake○ sign inNothing errors because dropping unmatched lines is documented behaviour. Counting the tagged failures converts an invisible leak into a number, and numbers have owners.Open full answer →
42Design log search for four hundred services and fifty teams, at ten terabytes a day.▼expertDatadogElasticSnowflake2 notes & comments◆ premiumThe hard parts are not search. They are deciding what to keep before you pay to store it, isolating one team's query from everyone else's, and making the cost visible to the people generating it.Open full answer →
31You need prompt and response logs to debug an AI feature, and legal says no. How do you resolve it?▼hardStripeSalesforceAtlassian2 notes & comments◆ premiumPrompts contain whatever the user typed, which in a support product is names, account numbers and medical detail. Full-text logging is a data-protection decision, not a debugging preference.Open full answer →
55Legal says the EU AI Act applies to a feature you host. What does the platform actually have to provide?▼hardSAPSalesforceMicrosoft2 notes & comments◆ premiumMost of the obligation lands on the product, but three parts land on infrastructure: an inventory of what is deployed, evidence of what it did, and the ability to turn it off. Those are platform capabilities and they take months to retrofit.Open full answer →
