Matching: log, metric or trace for each question Basic

Having enough data is not enough; a good on-call engineer knows which signal to open first for each question. Drag a signal onto each situation.

If you miss, the game explains why that signal is close but not right. The most commonly confused pairs: trace vs correlation ID, and metric vs log when you need to look up one specific customer.

Matching

Which signal does this question need?

Eight common on-call questions about a checkout system running many services, with Prometheus, JSON logs and OpenTelemetry tracing (5% head sampling). Drag the best-fitting signal onto each question. A card can be used more than once.

Tip: ask "do I need an aggregate number, or the details of one specific event?" before choosing.

Tap Choose answer on each case. On a computer you can drag a card below onto a case.

Log (structured event)Trace (distributed span tree)SLO burn-rate alertMetric (counter / histogram)Profile (CPU / heap)Correlation ID in logs

Solved 0/8 · 0 mistakes

1Your manager asks: what is the checkout p99 latency over the last 30 days, and did it get worse after this month's release?

Choose answer ▾

2A customer files a ticket: "My order #123 showed an error at 14:02". You need to know why that exact request failed.

{"event":"payment.failed","orderId":123,"trace_id":"4bf92f35...","reason":"card_declined","provider":"vnpay","duration_ms":812}

Choose answer ▾

3Checkout calls 6 downstream services (price, voucher, stock, payment, shipping, loyalty), some in parallel. p99 rose from 400 ms to 1.8 s. Which hop is slowing it down?

Choose answer ▾

4On-call gets paged 40 times a month for "CPU > 80%" and "ERROR in logs", and most of the time customers notice nothing. You want to page only when users are actually affected.

Choose answer ▾

5pricing-service runs at 100% CPU after a deploy, traffic is unchanged, and p99 tripled. You need to know which function is burning CPU.

Choose answer ▾

6Customer support sends the error code the customer saw. You need every log line for that request across the gateway, checkout, payment and the email-sending worker (via Kafka).

Choose answer ▾

7A dashboard needs the 5xx count per endpoint every minute, to see which route fails after a deploy.

sum by (route) (rate(http_requests_total{status=~"5.."}[5m]))

Choose answer ▾

8Customer support wants to know whether customer u_829113 hit any 5xx last week. A dev proposes adding a userId label to the counter "to make filtering easy". The system has 184,000 customers.

httpRequests.labels(route, status, req.user.id).inc();

Choose answer ▾

After playing, read Logs, metrics and traces to see the drill-down path from an alert through an exemplar and a trace to the logs.