A microservices team's log bill has grown sharply, but on-call engineers still need enough detail to diagnose incidents quickly. Which practice best balances these goals?
Show answer and explanation
Answer: B
Assigning appropriate severity levels lets teams filter by importance, and structured JSON entries make fields queryable without expensive text parsing. Excluding or rerouting verbose debug output in production, or sending it to cheaper storage, lowers ingestion costs while keeping errors and warnings readily available. Logging everything at debug level inflates costs, turning logging off removes the signal needed during incidents, and in-memory logs disappear on restart and cannot be searched across instances.
Why the other options are wrong
- A. Leaving debug output on in production inflates ingestion and storage costs without adding proportional value. Verbose logs should be filtered or routed to cheaper storage.
- C. Disabling logs removes visibility into failures and makes incident response slower. Cost control should come from filtering and severity levels, not from silence.
- D. Logs held only in memory are lost when a process restarts and cannot be searched centrally. This undermines troubleshooting for distributed services.