1Z0-1067-25 Question 118
Single answerYou are running a microservices-based application in Oracle Cloud Infrastructure (OCI) and need to be alerted any time 'ERROR' logs appear more than five times within one minute across all microservices. Which solution should you implement using only OCI services?
- A
Implement a custom script that periodically downloads logs from an Object Storage bucket and searches for 'ERROR' entries, triggering notifications through an external API.
- B
Use Logging Analytics to build a dashboard that displays error rates in real-time, integrating a third-party alerting tool for notifications.
- C
Define a log-based metric in the OCI Logging service that filters on 'ERROR' messages, then create a corresponding Alarm in the Monitoring service that triggers if the metric exceeds five occurrences in one minute.
- D
Configure the Logging service to directly send an alarm notification when five or more 'ERROR' messages are logged within one minute.
Show answer and explanation
Correct answer: C
Explanation
In OCI, you define log-based metrics in the Logging service to capture specific log patterns, such as 'ERROR' messages. The Monitoring service consumes these metrics, where you can configure Alarms to alert you when thresholds (e.g., occurrences per minute) are crossed. Refer to the Oracle Cloud Infrastructure Logging and Monitoring documentation for details on creating log-based metrics and setting up alarms: https://docs.oracle.com/en-us/iaas/Content/Logging/Concepts/logsbasedmetrics.htm and https://docs.oracle.com/en-us/iaas/Content/Monitoring/Concepts/monitoringoverview.htm.
- A. Incorrect.
Option 1 is incorrect because you would rely on a custom script and external API for notifications, which is not the most efficient or native OCI method. OCI provides built-in services for log-based metrics and alarms that do not require polling Object Storage or external alert mechanisms.
- B. Incorrect.
Option 2 is incorrect because while Logging Analytics can visualize and analyze logs, it does not inherently provide the native alerting mechanism needed for near real-time alarm notifications. You would still need OCI� Monitoring and Alarms to set thresholds and receive alerts, making a third-party alerting tool unnecessary.
- C. Correct.
Option 3 is correct. You can create a log-based metric in the Logging service to capture occurrences of 'ERROR' messages, then configure an Alarm in the Monitoring service to notify you whenever the count of 'ERROR' messages exceeds five back-to-back within one minute. This leverages only native OCI services and allows for near real-time notifications.
- D. Incorrect.
Option 4 is incorrect because you cannot create an alarm directly within the Logging service. Alarms are defined in the Monitoring service, though you can configure log-based metrics in Logging that the Monitoring service will use for alarm thresholds.