Chapter 70: DevOps Interview Questions by Topic and Company
70.10 Monitoring, Logging and SRE Interview Questions
Monitoring mhanje problem user chya aadhi pakadne. SLO aani golden signals he shabda vapra.
What you will learn in this lesson
- 24 real Monitoring, Logging and SRE questions with short answers
- Which companies asked them, from public interview stories
- Fresher, experienced and senior levels
- A simple way to answer: why, what, how
Why: the problem
You cannot fix what you cannot see. Interviewers ask how you watch systems, alert the right people and measure reliability.
What: how to read this lesson
Each question has a short answer in three parts.
- Why: the reason the thing exists.
- What: the plain meaning.
- How: how you use it, often with a small command.
"Asked at" names a company only when a public interview story says the question was asked there. No tag means it is a common question that many companies ask.
Companies with the most questions in this lesson: TCS (10), Walmart Global Tech (3), LTIMindtree (2), Capgemini (2), HCLTech (1), Accenture (1).
How: answer any question in 4 steps
- Start with the reason. One sentence.
- Give the plain meaning. No big words.
- Show one command or file.
- Add one example from your work. Then stop and wait.
Fresher questions
Q1. What is the difference between monitoring and observability?
Why: Modern teams expect observability.
What: Monitoring tells you something is wrong using known checks. Observability lets you ask new questions using metrics, logs and traces.
Q2. What are logs, metrics and traces?
Why: The three pillars.
What: Metrics: numbers over time (CPU, requests). Logs: event text. Traces: the path of one request across services.
How: Use all three together to find root cause.
Q3. What tools have you used for monitoring?
Why: Tool experience check.
What: Prometheus + Grafana for metrics, ELK/EFK or Loki for logs, CloudWatch on AWS, Jaeger/Tempo for traces.
How: Say what you watched and alerted on.
Q4. What is the default port of Prometheus?
Why: Simple fact, often asked.
What: 9090 (Grafana 3000, Node Exporter 9100, Alertmanager 9093).
Q5. What is the ELK stack?
Why: Popular logging stack.
What: Elasticsearch (store/search), Logstash (process), Kibana (view); Beats ship logs.
Q6. What is the difference between push and pull monitoring?
Why: Prometheus vs others.
What: Pull: the server scrapes targets (Prometheus). Push: agents send data (CloudWatch agent, Pushgateway for jobs).
Q7. What is Grafana?
Why: Common dashboard tool.
What: Grafana shows dashboards from many data sources (Prometheus, Loki, CloudWatch) and can alert.
Experienced questions (2-5 years)
Q8. What is a runbook?
Why: On-call needs clear steps.
What: A runbook is a short document of steps to handle an alert.
How: Link each alert to its runbook.
Q9. Explain Prometheus architecture.
Why: Core monitoring tool.
What: Prometheus pulls (scrapes) metrics from targets/exporters, stores them in a time-series database, and evaluates rules. Alertmanager sends alerts. Grafana shows dashboards.
How: Service discovery finds targets in Kubernetes.
scrape_configs:
- job_name: node
static_configs:
- targets: ["10.0.1.10:9100"]
Q10. How do you monitor a Kubernetes cluster with Prometheus?
Why: Common setup.
What: Use kube-prometheus-stack (Prometheus Operator, node-exporter, kube-state-metrics, Grafana).
How: Use ServiceMonitors for apps and set alerts for nodes, pods and API server.
helm install mon prometheus-community/kube-prometheus-stack -n monitoring --create-namespace
Q11. How do you send Prometheus alerts to Slack?
Why: Alerts must reach people.
What: Alertmanager routes alerts to receivers.
How: Add a slack_configs receiver with a webhook from a secret.
receivers:
- name: slack
slack_configs:
- channel: "#alerts"
api_url_file: /etc/alertmanager/slack_url
Q12. Prometheus is not showing metrics for a target. How do you fix it?
Why: Common breakage.
What: Scrape is failing or the target is not found.
How: Check Targets page, network/port, path /metrics, labels on the ServiceMonitor, and scrape errors.
curl http://10.0.1.10:9100/metrics | head
Q13. How do you set up centralised logging?
Why: Logs on many servers are hard to search.
What: Agents ship logs to one store.
How: Fluent Bit/Filebeat → Elasticsearch/OpenSearch or Loki → Kibana/Grafana; add retention and access control.
Q14. What are SLI, SLO and SLA?
Why: SRE basics.
What: SLI: a measured number (e.g. % successful requests). SLO: the target (99.9%). SLA: a contract with penalties.
How: SLO is stricter than SLA.
Q15. What is an error budget?
Why: It balances speed and reliability.
What: Error budget = 100% − SLO. At 99.9%, about 43 minutes of downtime a month.
How: If the budget is used up, slow releases and fix reliability.
Q16. What are the four golden signals?
Why: Google SRE concept.
What: Latency, traffic, errors, saturation.
How: Alert and build dashboards on these first.
Q17. What is toil?
Why: SRE teams cut toil.
What: Toil is manual, repeated, automatable work that grows with scale.
How: Measure it and automate it.
Q18. How do you set up CloudWatch and Grafana for AWS?
Why: Common in AWS projects.
What: CloudWatch collects AWS metrics and logs; Grafana can use CloudWatch as a data source.
How: Install the CloudWatch agent for memory/disk metrics, create alarms, and build Grafana dashboards.
Q19. How do you avoid alert fatigue?
Why: Too many alerts get ignored.
What: Alert on symptoms users feel, not on every metric.
How: Use severity levels, for: durations, grouping, and remove alerts nobody acts on.
for: 5m
Q20. What is PromQL? Give an example.
Why: You must query metrics.
What: PromQL is Prometheus's query language.
How: Example: request rate and error ratio.
sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m]))
Q21. What is distributed tracing?
Why: Microservices need it.
What: Tracing follows one request across services using a trace ID.
How: Use OpenTelemetry SDKs and send to Jaeger or Tempo.
Q22. What is blackbox monitoring?
Why: Check from the user's side.
What: It tests endpoints from outside (HTTP, TCP, DNS) without knowing the internals.
How: Use blackbox_exporter or synthetic checks.
Q23. How do you monitor and fix pod errors in production?
Why: Combines K8s and monitoring.
What: Alerts on restarts, OOMKilled, and failed readiness.
How: Use kube-state-metrics alerts, then describe/logs, and dashboards per service.
kube_pod_container_status_restarts_total
Senior questions
Q24. What does five nines availability mean?
Why: High availability talk.
What: 99.999% = about 5 minutes of downtime per year.
How: It needs redundancy everywhere and very fast detection and recovery.
Practice tasks
Medium Explain Prometheus architecture.
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you monitor a Kubernetes cluster with Prometheus?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you send Prometheus alerts to Slack?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium Prometheus is not showing metrics for a target. How do you fix it?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you avoid alert fatigue?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium What is PromQL? Give an example.
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you monitor and fix pod errors in production?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Homework: try at home
- Pick five questions you find hard.
- Write your own answer for each in three lines.
- Record yourself answering them. Listen once and improve.
Recap
In short
- Answer in order: why, what, how, then one example.
- Show one small command when you can.
- "Asked at" comes from public interview stories.
- Practise aloud; do not memorise word for word.
FAQ
Do I need to learn all 24 questions?
No. Start with the fresher ones. Then add the experienced ones for your level.
Should I memorise these answers?
No. Understand the why, then say it in your own words. Interviewers notice memorised lines.
What if I do not know an answer?
Say so honestly. Then explain how you would find out, step by step.
Are these questions only for one company?
No. "Asked at" shows where people said it was asked. Other companies ask the same things.
How long should an answer be?
About 30 to 60 seconds. Give a reason, a plain meaning and one example.
Is a lab really needed?
Yes. Running the command once makes your answer real and confident.
Interview questions
Practise these five first. Many companies asked them.
- What tools have you used for monitoring? - Prometheus + Grafana for metrics, ELK/EFK or Loki for logs, CloudWatch on AWS, Jaeger/Tempo for traces.
- How do you monitor a Kubernetes cluster with Prometheus? - Use kube-prometheus-stack (Prometheus Operator, node-exporter, kube-state-metrics, Grafana).
- What is Grafana? - Grafana shows dashboards from many data sources (Prometheus, Loki, CloudWatch) and can alert.
- What are logs, metrics and traces? - Metrics: numbers over time (CPU, requests).
- What is the default port of Prometheus? - 9090 (Grafana 3000, Node Exporter 9100, Alertmanager 9093).
Quick quiz
Q1. What is a runbook?
A runbook is a short document of steps to handle an alert.
Q2. Prometheus is not showing metrics for a target. How do you fix it?
Scrape is failing or the target is not found.
Q3. How do you set up CloudWatch and Grafana for AWS?
CloudWatch collects AWS metrics and logs; Grafana can use CloudWatch as a data source.
Samajla ka?
Revision card
Interview card