During an incident, the team cannot find useful logs for the failing API. How would you investigate?

Debug missing logs during an incident

Explains how to troubleshoot absent logs or telemetry by checking configuration, sampling, sinks, levels, deployment, and correlation.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I would check whether the app is producing logs and whether the platform is ingesting them. That means log level configuration, environment-specific settings, connection string or instrumentation key, sink permissions, sampling, filters, and whether the failing code path logs before the exception is swallowed. I would also verify the deployment slot or instance I am looking at is the one serving traffic.

Full answer below

Practice focus

Logging configuration, log levels, sinks, sampling, deployment slots, correlation, exception handling, and telemetry ingestion.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Missing telemetry turns a normal incident into a guessing game. Debugging the observability path is sometimes the first incident task.
I would check whether the app is producing logs and whether the platform is ingesting them. That means log level configuration, environment-specific settings, connection string or instrumentation key, sink permissions, sampling, filters, and whether the failing code path logs before the exception is swallowed. I would also verify the deployment slot or instance I am looking at is the one serving traffic.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would search by correlation id, time window, endpoint, exception type, instance id, and deployment version. If logs are missing only for one path, the code may be catching exceptions without logging or returning generic errors. If all logs are missing, the issue is likely configuration, telemetry initialization, network/ingestion, or a release that changed logging setup. I would use platform logs, stdout, or temporary safe diagnostics to recover signal.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Assuming no logs means no errors.
Searching the wrong environment, slot, or time zone.
Adding broad debug logging with sensitive data.
Forgetting sampling and log-level filters.

During an incident, the team cannot find useful logs for the failing API. How would you investigate?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section

Technologies

Tech stacks

Skill areas

Suggest an improvement