Section 1: Three Products Wearing One Name - Problem Understanding & Clarifications

Executive Summary: Most candidates answer this prompt with a shopping list of tools, which skips the design. "Logging and monitoring" is three products (log search, metrics and dashboards, alerting) with different readers and different read patterns, sharing one collection fabric. Six clarifying questions fix the scale, cut tracing and security detection out of day one, and turn "paged within a minute" into a deadline we can budget. We also meet Dana, whose 02:14 incident is the test every later section has to pass.

The interviewer reads from a card:

"Design the logging and monitoring platform for a company running about 5,000 microservices on 50,000 hosts across three regions. Engineers need to search logs from the last few minutes back to 30 days, watch dashboards of service metrics, and get paged within a minute when something breaks."

The tempting answer is product names: a search cluster for logs, a time-series database for metrics, a dashboard tool on top. That answers "what would you install?", not "what are you building?", and it hides the question that decides the design: who reads this data, and how?

Decomposing the Prompt

Before asking anything, break the territory down out loud:

• What it does: Collects two kinds of signal from every host (log lines and metric samples), keeps them, and answers questions about them: search, charts, and "should a human wake up?"
• Who uses it: Engineers debugging, engineers watching dashboards and wall screens, and a machine: the rule evaluator that decides when to page.
• Why it exists: To shorten incidents. Every minute between "something broke" and "someone knows why" costs revenue or trust.
• How it's used: Mostly nobody is looking. Then, during an incident, everyone is, and it has to answer fast while the thing it watches is on fire.