Datadog Log Management Fundamentals free question 10 / 10 · Domain 6: Log Troubleshooting
Some logs appear neither in Live Tail nor in the Log Explorer. You find that the timestamps inside these logs are far in the past. Which condition does the Logs Troubleshooting page give for logs that are dropped at intake?
- Logs whose timestamp is more than 7 days in the past
- Logs whose timestamp is further than 18 hours in the past
- Logs that arrive after the daily quota has been reached
- Logs whose epoch timestamp is in a timezone other than UTC
Show the answer and explanation
Answer: B
Why this is correct
The section "Missing logs - timestamp outside of the ingestion window" says: "Logs with a timestamp further than 18 hours in the past are dropped at intake." It then tells you to fix the issue at the source by checking which service and source are impacted with the datadog.estimated_usage.logs.drop_count metric. Logs dropped at intake never reach Datadog, which is why they are missing from Live Tail as well as from the Log Explorer.
Why the other options are wrong
"Logs whose timestamp is more than 7 days in the past" … 7 days comes from the Log Collection page, where a Preview lets you submit logs from up to 7 days in the past if you register for it. The ingestion window that drops logs is 18 hours.
"Logs that arrive after the daily quota has been reached" … Reaching the daily quota is its own case on the page, where logs are missing for today although you have not changed the log configuration. The case here is a timestamp far in the past.
"Logs whose epoch timestamp is in a timezone other than UTC" … Datadog parses epoch timestamps using UTC, and logs in another timezone appear shifted by the offset, for example 5 hours in the past from New York. They are shifted, not dropped.
Related setting
The drop_count metric shows which service and source lose logs, which points to the sender whose clock or timestamp handling needs fixing. The Log Collection Troubleshooting Guide gives the same 18-hour condition: when logs do not appear in Live Tail, they might have been dropped because their timestamp was further than 18 hours in the past. Fixing the source matters, because dropped logs cannot be recovered later.