Debugging scenarioMedium~10 min

Interview question

During an incident, the team cannot find useful logs for the failing API. How would you investigate?

Debug missing logs during an incident

Explains how to troubleshoot absent logs or telemetry by checking configuration, sampling, sinks, levels, deployment, and correlation.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I would check whether the app is producing logs and whether the platform is ingesting them. That means log level configuration, environment-specific settings, connection string or instrumentation key, sink permissions, sampling, filters, and whether the failing code path logs before the exception is swallowed. I would also verify the deployment slot or instance I am looking at is the one serving traffic.

Full answer below

Practice focus

Logging configuration, log levels, sinks, sampling, deployment slots, correlation, exception handling, and telemetry ingestion.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Missing telemetry turns a normal incident into a guessing game. Debugging the observability path is sometimes the first incident task.
I would check whether the app is producing logs and whether the platform is ingesting them. That means log level configuration, environment-specific settings, connection string or instrumentation key, sink permissions, sampling, filters, and whether the failing code path logs before the exception is swallowed. I would also verify the deployment slot or instance I am looking at is the one serving traffic.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would search by correlation id, time window, endpoint, exception type, instance id, and deployment version. If logs are missing only for one path, the code may be catching exceptions without logging or returning generic errors. If all logs are missing, the issue is likely configuration, telemetry initialization, network/ingestion, or a release that changed logging setup. I would use platform logs, stdout, or temporary safe diagnostics to recover signal.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I avoid enabling broad emergency logging that leaks secrets, changes hot-path timing, or overwhelms ingestion. I make the smallest bounded change that restores signal, scope it to the affected service or route where possible, set an expiry, and verify it with a known safe request. Platform logs, traces, metrics, and provider diagnostics remain alternate evidence while the primary sink is impaired. After recovery I add telemetry canaries or heartbeat alerts, test exporter and permission failures, document a fallback diagnostic path, and verify that deploy changes cannot silently disable the signals required for incident response.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Assuming no logs means no errors.
Searching the wrong environment, slot, or time zone.
Adding broad debug logging with sensitive data.
Forgetting sampling and log-level filters.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

No way to validate the telemetry pipeline.
No correlation or instance context.
Cannot distinguish app logging from platform ingestion.
No follow-up guard for missing telemetry.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

What config could suppress logs?
How would you prove logging works after a fix?
What telemetry should alert when it disappears?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

2 linked

Go deeper

Practice the next layer of the same subject.

Missing Telemetry

Try a variant

Answer a similar question in a different context.

No Useful Logs

Opening drill

Debugging scenarioMedium~10 min

Interview question

During an incident, the team cannot find useful logs for the failing API. How would you investigate?

Debug missing logs during an incident

Explains how to troubleshoot absent logs or telemetry by checking configuration, sampling, sinks, levels, deployment, and correlation.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Logging configuration, log levels, sinks, sampling, deployment slots, correlation, exception handling, and telemetry ingestion.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Missing telemetry turns a normal incident into a guessing game. Debugging the observability path is sometimes the first incident task.
I would check whether the app is producing logs and whether the platform is ingesting them. That means log level configuration, environment-specific settings, connection string or instrumentation key, sink permissions, sampling, filters, and whether the failing code path logs before the exception is swallowed. I would also verify the deployment slot or instance I am looking at is the one serving traffic.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would search by correlation id, time window, endpoint, exception type, instance id, and deployment version. If logs are missing only for one path, the code may be catching exceptions without logging or returning generic errors. If all logs are missing, the issue is likely configuration, telemetry initialization, network/ingestion, or a release that changed logging setup. I would use platform logs, stdout, or temporary safe diagnostics to recover signal.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I avoid enabling broad emergency logging that leaks secrets, changes hot-path timing, or overwhelms ingestion. I make the smallest bounded change that restores signal, scope it to the affected service or route where possible, set an expiry, and verify it with a known safe request. Platform logs, traces, metrics, and provider diagnostics remain alternate evidence while the primary sink is impaired. After recovery I add telemetry canaries or heartbeat alerts, test exporter and permission failures, document a fallback diagnostic path, and verify that deploy changes cannot silently disable the signals required for incident response.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Assuming no logs means no errors.
Searching the wrong environment, slot, or time zone.
Adding broad debug logging with sensitive data.
Forgetting sampling and log-level filters.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

No way to validate the telemetry pipeline.
No correlation or instance context.
Cannot distinguish app logging from platform ingestion.
No follow-up guard for missing telemetry.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

What config could suppress logs?
How would you prove logging works after a fix?
What telemetry should alert when it disappears?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

2 linked

Go deeper

Practice the next layer of the same subject.

Missing Telemetry

Try a variant

Answer a similar question in a different context.

No Useful Logs

During an incident, the team cannot find useful logs for the failing API. How would you investigate?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Go deeper

Try a variant

During an incident, the team cannot find useful logs for the failing API. How would you investigate?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Go deeper

Try a variant