Overview
This section covers the full observability workflow in Google Cloud Observability. You collect logs from the Ops Agent, OpenTelemetry, Cloud Audit Logs, VPC Flow Logs and Cloud Service Mesh; trim them with filters, sampling and exclusions; gather metrics from applications, platforms, networks and Managed Service for Prometheus; build synthetic monitors; and create custom and log-based metrics.
Analysis comes next. Logs Explorer and the Logging query language find events, sinks route logs to BigQuery, Pub/Sub or Cloud Storage, and log processing redacts PII and PHI. Metrics Explorer, dashboards with PromQL and alerting policies tied to SLOs and cost turn metrics into action, with integrations such as webhooks and PagerDuty. OpenTelemetry traces show where latency lives. Gemini Cloud Assist helps interpret logs, metrics and traces, and a final subsection tests troubleshooting.
How it's tested
Section 4 questions typically state a visibility gap or a symptom and ask which signal, tool or configuration closes it. Google expects managed collection where possible, cost-aware logging, alerts that reflect user impact, and correlation between logs, metrics and traces rather than reading each in isolation.
-
Collect the missing signal
You pick the Ops Agent, OpenTelemetry, Managed Service for Prometheus, VPC Flow Logs or a log-based metric to capture data that is not yet visible.
-
Route and retain logs
You choose a sink destination and retention for analytics, streaming or archive needs while excluding noisy or sensitive entries.
-
Find the failing component
Given symptoms, you correlate traces, logs and metrics to locate the service, step or resource at fault.
Users report slow checkout, but CPU and memory look normal on every service. Metrics alone cannot show which downstream call is slow. Instrumenting the services with OpenTelemetry and viewing the request in Cloud Trace shows a span for an inventory database call taking most of the time, and the trace ID links to the matching structured log entries for that request.
Objectives 5
Official objectives from the Google Cloud outline, in outline order.
4.1 Instrumenting and collecting telemetryLog and metric collection, log optimization, synthetic monitors and custom metrics.
- What it means
- This covers collecting and importing logs from the Ops Agent, OpenTelemetry, Cloud Audit Logs, VPC Flow Logs and Cloud Service Mesh; optimizing logs with filtering, sampling, exclusions, cost management and source choices; collecting metrics from applications, platforms, networking, Cloud Service Mesh, Managed Service for Prometheus and hybrid or multi-cloud sources; creating synthetic monitors; and building custom and log-based metrics.
- What to understand
- The Ops Agent collects system and third-party application logs and metrics from Compute Engine VMs. GKE and Cloud Run send logs automatically. Managed Service for Prometheus collects Prometheus metrics without running your own Prometheus storage. Exclusion filters on the _Default sink stop low-value logs from being stored, reducing cost. Data Access audit logs are mostly off by default and must be enabled. Log-based metrics count or extract values from matching entries, and synthetic monitors run scripted checks against endpoints.
- How it shows up
- Expect a gap in visibility or a logging bill problem, and you pick the agent, exclusion or metric type.
- Common confusion
- An exclusion stops storage in that bucket, but logs can still be routed by other sinks before exclusion applies.
4.2 Managing and analyzing logsLogs Explorer, Logging query language, export and retention, redaction and Gemini analysis.
- What it means
- This covers analyzing logs with Logs Explorer and the Logging query language, exporting and retaining logs in BigQuery, Pub/Sub or Cloud Storage, handling sensitive data with log processing that redacts PII and PHI, and using Gemini Cloud Assist for AI-assisted log analysis.
- What to understand
- Sinks route matching entries to log buckets, BigQuery for SQL analysis, Pub/Sub for streaming to other systems, or Cloud Storage for low-cost long-term archive. Log buckets have configurable retention, and Log Analytics lets you query bucket data with SQL. The _Required bucket holds admin activity audit logs and cannot be changed. Sensitive fields should be redacted before or during ingestion, for example with Sensitive Data Protection. Gemini Cloud Assist can summarize and explain log entries during investigation.
- How it shows up
- A retention, compliance or analysis need is described, and you choose the sink destination and redaction method.
- Common confusion
- Pub/Sub is for streaming to consumers, not for long-term retention or analytics.
4.3 Managing metrics, dashboards, and alertsMetrics Explorer, dashboards and PromQL, alerting policies, third-party tools and Gemini.
- What it means
- This covers analyzing metrics with Metrics Explorer; creating, filtering and sharing dashboards, adding playbooks and using PromQL; configuring alerting policies based on SLIs, SLOs and cost; integrating third-party alerting such as webhooks, PagerDuty and Rootly; and using Gemini Cloud Assist to interpret metrics.
- What to understand
- Metrics Explorer is for ad hoc charting, while dashboards are saved and shared views, and PromQL works across Cloud Monitoring metrics. Alerting policies combine a condition, notification channels and documentation that can hold a playbook for responders. SLO burn-rate conditions suit user-facing alerts, while budget alerts come from Cloud Billing. Notification channels include email, SMS, Pub/Sub, webhooks and PagerDuty.
- How it shows up
- Expect to design an alert that pages responders only for user impact and links them to a runbook.
- Common confusion
- A dashboard shows data but notifies nobody; paging requires an alerting policy with a channel.
4.4 Capturing and analyzing distributed tracesOpenTelemetry, trace waterfalls and spans, trace-log correlation and Gemini analysis.
- What it means
- This covers using tracing frameworks such as OpenTelemetry, analyzing trace waterfalls and spans, correlating trace IDs with structured logs, and using Gemini Cloud Assist for AI-assisted trace analysis.
- What to understand
- A trace records one request as a tree of spans, each with timing for one operation, and the waterfall view shows which span dominates latency. OpenTelemetry is the vendor-neutral instrumentation standard and exports to Cloud Trace. Writing the trace ID into structured log entries using the logging.googleapis.com/trace field lets Logs Explorer show all logs for a trace. Sampling controls trace volume and cost.
- How it shows up
- Expect a latency mystery across microservices that only tracing can explain.
- Common confusion
- Profiling finds expensive code inside one service; tracing finds slow hops between services.
4.5 Troubleshooting issuesInfrastructure, CI/CD, application, observability and performance problems.
- What it means
- This covers troubleshooting infrastructure issues, CI/CD pipeline issues, application issues, observability issues such as missing telemetry, and performance and latency issues.
- What to understand
- Good troubleshooting starts from symptoms in metrics, narrows with traces, and confirms with logs. Pipeline failures often come from missing IAM roles on the build service account, unavailable artifacts or quota limits. GKE issues include CrashLoopBackOff, image pull errors and Pods pending on resources. Missing telemetry usually means an agent is not installed, the service account lacks the logs or metrics writer role, or an exclusion is dropping entries.
- How it shows up
- A symptom and some evidence are given, and you choose the most likely cause or the next diagnostic step.
- Common confusion
- Missing logs are not always an application bug; check agent, permissions and exclusions first.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Ops Agent
Single agent for logs and metrics on Compute Engine VMs.
- Remember
- Needed for third-party app and system telemetry on VMs.
- Tested as
- Collection gap questions.
- Trap
- Expecting VMs to send app logs without it.
-
Managed Service for Prometheus
Google-managed Prometheus collection and storage.
- Remember
- Query with PromQL; no self-run Prometheus storage.
- Tested as
- Kubernetes metrics.
- Trap
- Running a self-managed Prometheus stack by default.
-
Exclusion filter
Stops matching logs from being stored by a sink.
- Remember
- Reduces ingestion cost.
- Tested as
- Log cost control.
- Trap
- Excluding audit logs needed for compliance.
-
Log sink
Routes log entries to a bucket, BigQuery, Pub/Sub or Cloud Storage.
- Remember
- Aggregated sinks cover folders or organizations.
- Tested as
- Export and retention.
- Trap
- Choosing Pub/Sub for archive.
-
_Required bucket
Holds admin activity and system event audit logs.
- Remember
- Fixed retention, cannot be excluded.
- Tested as
- Audit log questions.
- Trap
- Trying to delete or exclude these logs.
-
Data Access audit logs
Logs of reads and writes to user data.
- Remember
- Mostly disabled by default; enable explicitly.
- Tested as
- Compliance auditing.
- Trap
- Assuming they are on automatically.
-
Log-based metric
Counter or distribution metric derived from matching log entries.
- Remember
- Lets you alert on a log pattern.
- Tested as
- Custom alerting.
- Trap
- Searching logs manually for recurring errors.
-
Synthetic monitor
Scripted check that probes an endpoint or user flow.
- Remember
- Detects outages before users report them.
- Tested as
- Proactive monitoring.
- Trap
- Relying only on internal metrics.
-
Alerting policy
Condition plus notification channels and documentation.
- Remember
- Add a playbook in the documentation field.
- Tested as
- Alert design.
- Trap
- Expecting a dashboard to notify anyone.
-
PromQL
Prometheus query language usable in Cloud Monitoring.
- Remember
- Works in dashboards and alert conditions.
- Tested as
- Metrics analysis.
- Trap
- Assuming it only works with self-hosted Prometheus.
-
OpenTelemetry
Vendor-neutral standard for traces, metrics and logs.
- Remember
- Exports to Cloud Trace and Cloud Monitoring.
- Tested as
- Instrumentation questions.
- Trap
- Using proprietary SDKs when portability is required.
-
Trace-log correlation
Trace ID written into structured log entries.
- Remember
- Shows every log line for one request.
- Tested as
- Distributed debugging.
- Trap
- Unstructured logs without trace fields.
-
Gemini Cloud Assist
AI assistance for investigating logs, metrics and traces.
- Remember
- Helps explain and summarize telemetry.
- Tested as
- AI-assisted operations.
- Trap
- Treating it as a replacement for alerts.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Log sink destinations
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Log bucket | Cloud Logging storage with configurable retention. | Queried in Logs Explorer and Log Analytics. | Default retention may be too short for compliance. |
| BigQuery | Dataset for SQL analysis of logs. | Best for joins, reporting and long analytical queries. | Costs more than archive storage for rarely read logs. |
| Pub/Sub | Streams entries to subscribers. | Feeds third-party SIEMs or custom processors. | It is not a retention store. |
| Cloud Storage | Low-cost object storage for archive. | Long retention with lifecycle and retention locks. | Not suited to interactive querying. |
Three telemetry signals
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Metrics | Numeric time series. | Cheap to store, ideal for alerts and dashboards. | They show that something is wrong, rarely why. |
| Logs | Detailed event records. | Rich context for a single event. | High volume drives cost if not filtered. |
| Traces | Timed spans for a single request across services. | Locate latency between services. | Need instrumentation and sampling decisions. |
Metrics views
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Metrics Explorer | Ad hoc charting of any metric. | Exploration during an investigation. | Charts are not saved for the team unless added to a dashboard. |
| Dashboard | Saved, shared collection of charts. | Ongoing visibility and handoff. | It does not send notifications. |
| Alerting policy | Condition that triggers notifications. | Brings humans or automation in. | Too many conditions cause alert fatigue. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Exclude audit logs to save money
- What candidates pick
- Add an exclusion that drops all audit logs.
- Why it looks right
- Audit logs can be high volume.
- Why it's wrong
- Admin activity logs cannot be excluded, and Data Access logs are often required for compliance; target noisy debug logs instead.
Clue to watch for A cost reduction request in a regulated company.
-
Self-hosted Prometheus
- What candidates pick
- Deploy Prometheus servers with persistent disks in each cluster.
- Why it looks right
- Teams already know Prometheus.
- Why it's wrong
- Managed Service for Prometheus keeps PromQL and exporters while removing storage and scaling work.
Clue to watch for Requests to reduce operational overhead.
-
Grep logs for a pattern
- What candidates pick
- Search Logs Explorer every morning for the error string.
- Why it looks right
- It finds the entries.
- Why it's wrong
- A log-based metric with an alerting policy detects the pattern automatically and notifies responders.
Clue to watch for A recurring log message that should trigger action.
-
CPU alert for user pain
- What candidates pick
- Alert when CPU exceeds 80%.
- Why it looks right
- High CPU often precedes problems.
- Why it's wrong
- CPU does not measure what users feel; SLO-based or error and latency alerts are better signals.
Clue to watch for Requirements about customer impact.
-
Metrics for cross-service latency
- What candidates pick
- Add more latency metrics to each service.
- Why it looks right
- Metrics are already in place.
- Why it's wrong
- Per-service metrics cannot show which hop in one request is slow; distributed tracing shows the span breakdown.
Clue to watch for A slow request that crosses several microservices.
-
Blame the app for missing logs
- What candidates pick
- Change the application logging library.
- Why it looks right
- The logs are missing from the app.
- Why it's wrong
- Missing telemetry is usually an agent, IAM writer role or exclusion problem; check those first.
Clue to watch for Logs stopped after an infrastructure or IAM change.
Answer framework
Use this order for Section 4 questions about missing visibility, noisy telemetry or an unexplained symptom.
- Name the question you need answered and the signal that answers it: metrics for trends, logs for events, traces for request paths.
- Check collection: Ops Agent on VMs, automatic GKE and Cloud Run logging, Managed Service for Prometheus, OpenTelemetry instrumentation and enabled audit logs.
- Control volume and sensitivity with exclusions, sampling and redaction before deciding where sinks route data and how long it is kept.
- Turn important signals into alerting policies based on SLOs, errors or latency, with channels and a playbook, rather than dashboards alone.
- When troubleshooting, move from metrics to traces to logs, linking them by trace ID, and use Gemini Cloud Assist to speed interpretation.
Practice question
Want more like this? The GCP PCDOE practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Spend most of your time in the console for this section. Deploy a small application on a Compute Engine VM with the Ops Agent, on GKE and on Cloud Run, then compare where each sends logs and metrics. Create a log-based metric from an error message, an alerting policy on it with a webhook channel, and a dashboard that uses PromQL. Add an exclusion filter for debug logs and watch the ingestion volume drop.
Next, set up sinks to BigQuery and Cloud Storage and an aggregated sink at a folder. Instrument two services with OpenTelemetry, call one from the other, and find the slow span in Cloud Trace, then jump to the matching log entries. Try Gemini Cloud Assist on an error. For troubleshooting, collect a short list of failure signatures and their usual causes. Finish with mixed practice questions, since this section overlaps with all others and rewards quick signal selection.
FAQ
How much of the GCP PCDOE exam is Implementing observability practices and troubleshooting issues?
Google weights Section 4, Implementing observability practices and troubleshooting issues, at about 25%. That is roughly 13 to 15 questions, as an editorial estimate.
Is Cloud Operations the same as Google Cloud Observability?
Yes. Google now uses the Google Cloud Observability name for Cloud Logging, Cloud Monitoring, Cloud Trace and related tools that were previously grouped as the operations suite.
Do I need to write OpenTelemetry code?
You should know what instrumentation does, how spans and context propagation work and how data reaches Cloud Trace. Detailed SDK code is unlikely to be tested.
How is AI-assisted analysis tested?
The guide names Gemini Cloud Assist for log, metric and trace analysis. Expect to recognize when it helps an investigation, not to know prompt details.
What is the difference between uptime checks and synthetic monitors?
Uptime checks test whether an endpoint responds. Synthetic monitors run scripted tests that can walk through a multi-step flow, which catches broken journeys that a simple check would miss.
Why does troubleshooting appear here rather than in other sections?
Troubleshooting depends on telemetry. Subsection 4.5 brings infrastructure, pipeline, application and latency problems together and expects you to use logs, metrics and traces to diagnose them.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
Test whether you can choose the right telemetry, sink and alert, and diagnose failures from logs, metrics and traces.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the GCP PCDOE AI tutor Get any concept explained your way