Datadog Log Management Fundamentals free question 9 / 10 · Domain 5: Log Utilization
A log monitor is grouped by service with the condition below 1. The service payment stops sending logs while the other services keep sending. Based on the documentation, what happens?
- The monitor as a whole goes into the NO DATA state for that period
- The group for payment, whose logs have stopped, triggers an alert
- No alert is triggered as long as some of the groups still have logs
- The groups of each service trigger, including those still sending
Show the answer and explanation
Answer: C
Why this is correct
The "No data and below alerts" section of the Log Monitor page says: "When splitting the monitor by any dimension (tag or facet) and using a below condition, the alert is triggered if and only if there are logs for a given group, and the count is below the threshold—or if there are no logs for all of the groups." The payment group has no logs at all, so it is not a group with logs whose count is below the threshold, and the other groups still have logs. The monitor triggers only when no service sends logs, as in the example that triggers if and only if there are no logs for all services.
Why the other options are wrong
"The group for payment, whose logs have stopped, triggers an alert" … A group triggers on a below condition when there are logs for it and the count is below the threshold. The payment group has no logs, so it does not meet that condition while other groups have logs.
"The groups of each service trigger, including those still sending" … The other services keep sending logs, so their counts stay at 1 or more and do not meet below 1. The case where the monitor triggers is no logs for all of the groups.
"The monitor as a whole goes into the NO DATA state for that period" … NO DATA is the state given when no logs match the monitor query during the time frame. The logs of the other services still match the query.
Design tip
If you need to know reliably that one service has stopped, scope the query to that service. The page shows this second example: a monitor that triggers if there are no logs for the service backend. To be notified when all groups matching a query have stopped sending logs, the page suggests the condition below 1, which notifies when no logs match the monitor query across all aggregate groups.