Debugging with distributed traces: waterfall shapes, context propagation & sampling

Questions

1. 1
   Not answered. In a trace waterfall, Span B is drawn indented inside Span A and starts after A begins. What does that mean?
2. 2
   Not answered. A trace's root span lasts 800 ms. Its two direct children last 150 ms and 200 ms. What can you say about the other 450 ms?
3. 3
   Not answered. A parent span is much wider than its only child, with large stretches of unexplained time on both sides. What does that usually mean?
4. 4
   Not answered. Two sibling spans share a parent, and there's a gap between them with nothing else in the trace. What could cause the gap?
5. 5
   Not answered. Why might a trace waterfall and a service's log timestamps disagree about when something happened?
6. 6
   Not answered. What's the difference between a span attribute and a span event?
7. 7
   Not answered. A parent span holds many identical child spans of the same length, running one after another and filling most of the parent. What does that usually mean?
8. 8
   Not answered. Two traces of the same endpoint and code path look very different. One has a staircase of database queries, the other a single short span. What's the most likely reason?
9. 9
   Not answered. The three child spans below don't depend on each other, and none needs another's output. Yet the trace shows them running one after another. What's going on?
10. 10
    Not answered. You fix the problem above by starting all three calls before awaiting any of them. What should the parent's duration be closest to now?
11. 11
    Not answered. A service fans out to five independent calls. Four return in about 50 ms and one takes 310 ms. Why is the parent span 310 ms wide?
12. 12
    Not answered. A parent span fans out to many independent children and waits for all of them. Which statements are true?
13. 13
    Not answered. The waterfall shows the same child span repeated several times, with a longer gap before each repeat. What does this usually mean?
14. 14
    Not answered. A child span seems to start 30 ms before its parent. The child's service is healthy, and its logs show it started only after it received the request. What's the most likely explanation?
15. 15
    Not answered. You expect a trace to continue from checkout-api into shipping-service. Instead, the trace ends at checkout-api, and a separate trace starts in shipping-service at about the same moment. What's the most likely cause?
16. 16
    Not answered. Which of these, seen in a tracing system, point to broken context propagation somewhere in the request path?
17. 17
    Not answered. A span named resize-image takes 480 ms of a 500 ms parent, and a developer concludes that resizing is slow. In the code, the span wraps both the resize and a network upload of the result. What does this teach about span durations?
18. 18
    Not answered. The http.request span ends at 120 ms. A send-email span for the same request starts at 150 ms, drawn in its own row and connected by a link instead of nested inside. What does this usually mean?
19. 19
    Not answered. Which of these would make you suspect a span is async handoff work, rather than blocking work the parent waited on?
20. 20
    Not answered. Six database query spans in one trace share a pattern: a long, equal wait before each query runs, then a short burst of real work. What does that equal wait suggest?
21. 21
    Not answered. A team samples 1% of traces with head-based sampling. To keep every trace for one customer id, they add that filter to the sampler. Why does this often not work?
22. 22
    Not answered. Tail-based sampling decides whether to keep a trace only after the trace has finished. What's its main cost?
23. 23
    Not answered. In an incident review, someone says 'we have no traces for the outage.' What's the most likely reason?
24. 24
    Not answered. You need to know how often an error code occurred across all traffic last week, by hour. Which kind of telemetry answers this directly?
25. 25
    Not answered. A user id is fine as a span attribute but dangerous as a metric label. Which of these explain why?
26. 26
    Not answered. Which of these questions are best answered by reading an individual trace, rather than metrics or logs?
27. 27
    Not answered. A parent span fans out to 5 independent calls. Each call has a 2% chance of being slow, meaning a 98% chance of finishing within its p99 threshold. What's the probability, in whole percent, that at least one of the 5 is slow?
28. 28
    Not answered. A trace shows three independent calls made one after another: 120 ms, 260 ms, and 90 ms, for a parent of 470 ms. If they ran in parallel instead, about how many milliseconds would the parent save?
29. 29
    Not answered. A parent waits on 4 independent children that take 45 ms, 52 ms, 310 ms, and 60 ms. The parent does no work of its own. How long is the parent span, in milliseconds?