Frequently asked questions

Containers share the host OS kernel, so they are much lighter and faster.

Yes, it starts with the basic concepts and evolves towards advanced orchestration.

It is a text script containing instructions to build a Docker image.

A tool to define and run multi-container Docker applications.

It's a public registry where you can find and share Docker images.

Docker's native tool to orchestrate a cluster of Docker engines.

Yes, unless you use Docker volumes to persist data.

To reduce the final image size by excluding compilation tools.

Yes, you can impose CPU and RAM limits when starting it.

Kubernetes uses standard containers (often Docker or containerd) for orchestration.

It's a complete observability platform powered by artificial intelligence.

SaaS is hosted by Dynatrace, Managed is installed on your own infrastructure.

A single agent installed on your hosts that automatically collects all metrics and traces.

Davis causal AI uses the Smartscape topology and observed dependencies to group related anomalies into a single problem and point to the most likely root cause, with supporting evidence. Its accuracy depends on how complete the instrumentation is.

Dynatrace's data lakehouse, designed specifically for unified observability data.

Yes, Dynatrace integrates seamlessly with Docker, Kubernetes and OpenShift.

The 'Monitoring as Code' tool for managing your Dynatrace configurations as code.

Yes, with synthetic monitors (Synthetic Monitoring).

Through DDUs (Davis Data Units), which let you track the consumption of the different metrics.

Yes, there are several levels such as Associate, Advanced Observability, etc.

Vagrant is a command-line tool for creating and managing reproducible, portable, and easy-to-configure virtual development environments.

Vagrant focuses on managing full virtual machines (an isolated operating system), while Docker manages containers that share the host's kernel, making them lighter but less isolated at the OS level.

A box is the packaging format for Vagrant environments. It's a compressed base image of an operating system (e.g. Ubuntu, CentOS) from which the VM is created.

It's the central configuration file (written in Ruby syntax) that describes the machine type, its resources (CPU, RAM), shared folders, networking, and the configuration scripts to run.

Yes, Vagrant is provider-agnostic. While VirtualBox is the standard, it also supports VMware, Hyper-V, Docker, and even Cloud instances (AWS, Azure) via plugins.

It's the automation step where Vagrant installs software and configures the machine after it starts up, using Shell scripts or tools like Ansible, Chef, or Puppet.

It's a modern reverse proxy and load balancer designed for microservice architectures. It automatically discovers the configuration of your services.

Yes, it integrates natively with Let's Encrypt to automatically generate and renew TLS certificates.

v2 introduced the concepts of Routers, Middlewares and Services, offering a more flexible and powerful configuration than v1's frontends/backends.

It is an open-source automation tool for configuration management, application deployment, and orchestration of IT tasks.

No, Ansible is 'agentless'. It communicates with remote servers via SSH (for Linux/Unix) or WinRM (for Windows).

It is a YAML formatted file that describes a set of ordered tasks to be executed on one or more target servers (the inventory).

A distributed search and analytics engine based on Apache Lucene.

A logical collection of JSON documents, split into shards (Lucene indices) spread across the cluster's nodes. It is not the equivalent of a relational database: no tables or joins, and one schema (mapping) per index.

It is a partition of an index that lets data be distributed across several nodes.

It is the user interface for visualising and interacting with Elasticsearch data.

By using Role-Based Access Control (RBAC) features and Kibana spaces.

You can use Query DSL through the API, or KQL (Kibana Query Language) in the interface.

Yes, through Data Streams, which are optimised for time-based data.

With Snapshots stored in a repository (NFS, S3, etc.) and managed by SLM policies.

Yes, Elasticsearch supports Role Mapping with SAML, LDAP and other identity providers.

A node responsible for managing the cluster as a whole (index creation, node tracking).

An open source data collection engine to process and enrich events.

A series of data processing steps including inputs, filters, and outputs.

To parse and structure unstructured text into identifiable fields.

Beats is lightweight and collects data at the source, while Logstash is a heavy engine that centralizes and transforms the data.

An open-source monitoring and alerting system specialized in time series data.

It uses a 'pull' model where the server fetches metrics from the targets.

An agent that translates third-party metrics into a format Prometheus understands.

The powerful query language used to work with time series.

By using Pushgateway, since the 'pull' model doesn't suit very short-lived tasks.

No, Prometheus only handles metrics. Logstash handles logs.

Prometheus evaluates alerting rules and sends events to Alertmanager.

A tool for collecting resource usage metrics from Docker/Kubernetes containers.

Yes, Prometheus is Grafana's default and most widely used data source.

Yes, it includes service discovery mechanisms.

It is the on-demand access, via the Internet, to shared computing resources (servers, storage, applications) with a pay-as-you-go model.

IaaS provides the core infrastructure, PaaS offers a platform for developers, and SaaS provides finished software accessible via a browser.

It is the ability of a Cloud infrastructure to automatically increase or decrease its resources to adapt to the load in real time.

It's a standard and a set of open-source tools (API, SDK, Collector) for instrumenting, generating, collecting and exporting telemetry data (traces, metrics, logs).

It's OpenTelemetry's native protocol (OpenTelemetry Protocol) for transporting telemetry data efficiently and in a standardized way between the different components.

No, that's one of its major strengths. OTel is vendor-agnostic and can send data to many backends (Jaeger, Prometheus, Dynatrace, Datadog, etc.) via exporters, sparing you from vendor lock-in.

They are the standard names for attributes, spans and metrics (for example http.request.method or service.name). They make telemetry understandable by every tool; a whole chapter covers them.

Yes, it is the fourth signal, still in development: OTLP carries it and an eBPF profiler was donated to the project. The "Profiles" chapter explains the current state and how to link a span to its profile today.

It's an open-source platform for visualizing and analyzing metrics.

Grafana supports many sources such as Prometheus, Elasticsearch, InfluxDB, MySQL, PostgreSQL, etc.

Kibana is closely tied to Elasticsearch for logs, while Grafana is more agnostic and excels at metrics and multi-source integration.

Yes, Grafana has a powerful built-in alerting system.

Through authentication (LDAP, OAuth), HTTPS, and fine-grained permissions per folder and dashboard.

It makes dashboards dynamic (e.g. filtering by server or environment).

Yes, in JSON format to back them up or share them.

Grafana Cloud is a managed SaaS service; self-hosting gives you full control over the infrastructure.

Visual markers on graphs to indicate events (deployments, outages).

Yes, notably with Loki, the log solution built into the Grafana ecosystem.

It's first and foremost a culture of collaboration between development (Dev) and operations (Ops) teams, backed by practices (CI/CD, IaC) and automation tools.

CI (Continuous Integration) is the practice of integrating code into a shared repository frequently. CD (Continuous Delivery/Deployment) is the automation of releasing or deploying to production.

It's the practice of managing and provisioning infrastructure (servers, networks, load balancers) through versioned configuration files (code), such as with Terraform or Ansible, rather than through manual configuration.

With continuous delivery, every validated version can go to production in one click; with continuous deployment, it goes there automatically, with no human action. The "End-to-end CI/CD" chapter covers both.

It is recommended: labs use the command line, Docker and Git. The "Linux administration" course provides the required foundations.

They are lightweight agents from the Elastic stack installed on servers to collect data.

Filebeat collects and sends logs in a lightweight way, while Logstash is a heavy transformation engine.

An agent dedicated to collecting system and service metrics.

Elastic Agent is the new unified solution intended to replace individual Beats.

The centralized interface in Kibana for configuring and updating Elastic Agents at scale.

Yes, Winlogbeat is specifically designed for Windows event logs.

Mainly to Elasticsearch or Logstash, but also to Kafka or Redis.

No, they are written in Go and designed to be very lightweight.

Ready-to-use configurations for common systems (Nginx, MySQL) including dashboards.

Yes, they support SSL/TLS encryption and authentication.

It is an open-source container orchestration system that automates deployment, scaling, and management of containerized applications.

A Pod is the smallest deployable unit in Kubernetes, containing one or more containers. A Deployment is a higher-level object that manages ReplicaSets, which in turn ensure that a specific number of identical Pods are running at all times.

It is an abstraction that defines a logical set of Pods and a policy to access them (via a stable IP and port), acting as an entry point and internal load balancer.

It is an open-source, vendor-neutral telemetry collector designed to replace Grafana Agent. It is OpenTelemetry (OTel) compatible.

Yes, Alloy combines the features of Promtail and Grafana Agent and includes native support for OpenTelemetry.

Alloy uses a declarative syntax based on River (similar to Terraform's HCL) which simplifies pipeline creation.

Absolutely, Alloy offers full native support for receiving, processing, and exporting data (Traces, Logs, Metrics) via the OTLP protocol.

HAProxy is renowned for its extreme speed and reliability. Unlike Nginx, which is a versatile web server, HAProxy is a pure load balancing specialist with much finer health check and persistence features.

Yes, perfectly. It can either do 'SSL Pass-through' (letting the backend decrypt) or 'SSL Termination' (HAProxy decrypts and offloads the web servers).

An ACL (Access Control List) lets you make intelligent routing decisions based on criteria such as the URL, the source IP address or HTTP headers.

A distributed tracing backend from Grafana Labs that only requires object storage and integrates natively with Grafana, Loki and Prometheus.

Tempo stores traces in plain object storage without a heavy index and is queried with TraceQL; Jaeger relies on Elasticsearch or Cassandra.

Tempo's query language for searching spans by attributes, duration, status and parent/child relationships.

Via OTLP (gRPC 4317, HTTP 4318), directly from the OpenTelemetry SDKs or through Grafana Alloy.

A log aggregation system from Grafana Labs, inspired by Prometheus: it only indexes stream labels and stores the compressed content in object storage, which makes it cost-effective.

For application and infrastructure logs, often yes. If you need full-text search over large volumes without context, Elasticsearch remains a better fit.

LogQL, which is close to PromQL: label selectors, line filters, parsers and metric functions.

Grafana Alloy is the recommended collector; Promtail is deprecated.

It extends Prometheus with high availability, a global multi-cluster view and long-term storage in object storage.

No: Prometheus keeps collecting; Thanos adds components around it (sidecar, query, store...).

The sidecar is the simplest model (pull). Receive suits isolated clusters, agent mode and multi-tenancy (push via remote write).

Two compactors writing to the same bucket can corrupt the blocks.

No: Prometheus (or Alloy) keeps collecting the metrics; Mimir receives them via remote_write, stores them and serves them through the same PromQL API.

Thanos is added on top of existing Prometheus servers (sidecar) and offers downsampling; Mimir centralises via remote_write and provides native multi-tenancy and limits. Both store TSDB blocks in object storage.

Not to get started: classic block storage works without it. Recent versions offer a Kafka-based ingestion architecture to decouple reads and writes at large scale.

Yes, Mimir is open source (AGPLv3). Grafana Labs also offers a managed version (Grafana Cloud Metrics) and an enterprise edition.

It is the permanent sampling, in production, of process call stacks, to find out which functions consume CPU, memory or wait time.

Typically 1 to 3% CPU, thanks to sampling. eBPF is even lighter.

No with eBPF (CPU profiles); yes with the SDKs, which add business labels, memory profiles and links to traces.

Go, Java, Python, Ruby, Node.js, .NET and Rust via the SDKs; all compiled languages and several interpreted ones via eBPF.

No: Prometheus (or Mimir, Loki, Grafana) evaluates the rules; Alertmanager receives the alerts and handles grouping, routing and notifications.

Alertmanager deduplicates identical alerts; in a cluster, the members coordinate so that only one notification is sent.

Alertmanager for Prometheus rules managed as code; Grafana Alerting for multi-source rules. Keep a single place for your routes.

Alert on symptoms, group, inhibit, mute warnings at night and review non-actionable alerts every week.

The SLO is a measured internal objective; the SLA is a contractual commitment with penalties. The SLO is stricter than the SLA.

No: it is impossible and very expensive. You set an objective that matches user expectations and use the margin as a budget.

The speed at which the error budget is consumed: 1 exhausts it exactly over the window, 14.4 in just over two days out of 30.

Both generate equivalent Prometheus rules; Pyrra adds a web interface, Sloth a simple CLI and Grafana dashboards.

No: eBPF programs attach to the kernel and to existing processes. That is the whole point of the approach.

The kernel verifier prevents a program from crashing the kernel, but eBPF agents are privileged: they must be treated as sensitive components.

At least 5.8 for most modern tools, 5.15 or later recommended, with BTF enabled.

No, it complements it: eBPF covers the whole fleet effortlessly, while the OpenTelemetry SDKs provide business-level detail.

Yes, k6 is open source (AGPLv3). Grafana Cloud additionally offers managed distributed execution and synthetic monitoring.

Basic JavaScript is enough: scripts are short and the course examples are complete.

Several thousand HTTP VUs on a decent machine; beyond that, you distribute the load with k6-operator.

k6 favours tests written as code, versioned and automated in CI, with low resource consumption; JMeter offers a graphical interface and a large plugin ecosystem.

Yes, the Faro SDK is open source, and the receiver is part of Grafana Alloy. Grafana Cloud offers a managed version (Frontend Observability).

The SDK is lightweight and sends its data in batches; the impact is negligible for most sites.

It depends on the data collected and its purpose: if in doubt, initialise Faro after consent and minimise the data.

No: Faro measures performance and errors for technical teams; it is not a marketing audience tool.

Fluent Bit, written in C, uses a few megabytes of memory: it is built for per-node agents. Fluentd, written in Ruby, is still useful as an aggregator with its many plugins, but new deployments favour Fluent Bit.

Yes: it receives and sends OTLP (opentelemetry input and output) for logs, metrics and traces.

No: it queries Elasticsearch and stores its own objects there (dashboards, rules, data views).

KQL filters documents; ES|QL chains filters, calculations and aggregations. KQL is often used in Discover and ES|QL for analysis.

Kibana can be used for free; some features (third-party connectors, document-level security, advanced SLOs) depend on the licence.

Yes: Elastic Observability ingests OTLP and publishes its own OpenTelemetry distributions (EDOT).

It can replace its storage (via remote write) or the whole of Prometheus with vmagent and vmalert, while keeping PromQL and the same configuration files.

Thanks to an optimised storage format and compression, and low memory usage per active series.

Rarely at first: single-node handles several million active series. The cluster is for very large volumes and multi-tenancy.

Yes, it is a superset: PromQL queries work, and you get extra functions.

v2, built on the OpenTelemetry Collector, is the current version; v1 has reached end of life.

No: you use the OpenTelemetry SDKs, and Jaeger receives OTLP natively.

Elasticsearch, OpenSearch or Cassandra, optionally with Kafka as a buffer; never in-memory storage.

Tempo is cheaper to run and integrates with Grafana; Jaeger offers a standalone UI and relies on indexed databases.

The self-hosted version is open source; a paid cloud offering and an enterprise edition also exist.

Yes: instrumentation relies on OpenTelemetry, so you only change the Collector destination.

Yes, Zabbix is open source (AGPLv3 since 7.0); the vendor sells support and services.

Zabbix excels at traditional infrastructure, networks and SNMP with an all-in-one interface; Prometheus at cloud-native and Kubernetes environments. They coexist well.

Agent 2 (written in Go) is recommended: the same keys, plus plugins (Docker, databases) and better handling of active checks.

PostgreSQL with TimescaleDB for large installations; MySQL/MariaDB is also supported.

No: the 14-day free trial is enough for all the labs.

Yes, the agent receives OTLP and Datadog converts standard attributes into tags.

Control metric cardinality, filter and sample logs, and track usage with dedicated monitors.

Both are complete SaaS platforms; Datadog focuses on flexibility and its ecosystem of integrations, Dynatrace on automation and causal AI. See also the Dynatrace course.

A control plane for OpenTelemetry collectors: it builds pipelines, deploys them through rollouts over OpAMP and measures the volumes sent to backends.

No. The server pushes configurations and receives measurements; telemetry goes straight from collectors to destinations.

No: the Free plan (up to 10 collectors and 100 GB/day) is enough for every lab. A free license key is required.

Alloy is a collector distribution with its own syntax; Bindplane is a control plane that manages collector fleets. An article in the course compares them in detail.

A vendor of observability and evaluation tools for generative AI: Phoenix (open source) and Arize AX (platform).

OpenTelemetry conventions and instrumentations to trace LLMs, RAG and agents, used by Phoenix and Arize AX.

No: a local Ollama model, through its OpenAI-compatible API, is enough. An OpenAI key gives better judges for evaluations.

Phoenix to develop, evaluate and experiment, self-hosted; Arize AX to monitor production at scale.

Yes: the vast majority of servers, containers and Kubernetes nodes run Linux. Reading logs and managing services, permissions and networking is the foundation of every operations role.

Labs use Ubuntu 24.04 LTS. Red Hat equivalents (dnf, firewalld, SELinux) are given in the lessons: the concepts are the same.

A local virtual machine is enough (Multipass, Vagrant, VirtualBox) or a small cloud instance. Use a disposable machine: some labs change the firewall, SSH and disks.

It covers most of the LFCS (Linux Foundation) and RHCSA (Red Hat) objectives: users, storage, services, networking, security and scripting. The exams are hands-on, so redo the labs without the solution.

Unix is a system born in 1969 from which commercial systems derive (AIX, Solaris, macOS). Linux is a free kernel created in 1991 that follows Unix principles; the first chapter covers the differences.

Vector is an open source project (MPL 2.0 licence) maintained by Datadog; it sends data to dozens of destinations, not only Datadog.

Yes, to get the most out of Vector: VRL is a simple, typed language checked before execution, replacing regexes scattered across configurations.

Columnar storage compresses telemetry heavily and speeds up aggregations, even at high cardinality.

Not for everyday search in HyperDX; SQL becomes an asset for advanced analysis and joins with your business data.

No: the labs use LocalStack, which emulates AWS services on your machine with Docker. You can later run the same commands on a real account (free tier) by simply dropping the "local" prefix.

The community edition covers S3, Lambda, API Gateway, DynamoDB, SQS, SNS, CloudFormation, IAM (without policy enforcement), mocked EC2, and more. Some features (strict IAM enforcement, real RDS, EKS) need the paid edition or a real account.

Cloud Practitioner (CLF-C02) validates the fundamentals; Solutions Architect Associate (SAA-C03) is the most sought-after technical certification. Both have a preparation path at the end of the course.

Not for the labs: Azurite emulates Blob, Queue and Table, Functions run locally and Bicep compiles and is tested locally. A trial subscription then lets you deploy for real.

An Azure emulation by LocalStack exists in preview; the course favours Microsoft's official emulators (Azurite, Cosmos DB emulator, Functions Core Tools), which are stable and free.

AZ-900 validates the fundamentals with no prerequisites; AZ-104 validates administrator skills and requires hands-on practice. Both have a preparation path at the end of the course.

No: the labs use the official Pub/Sub and Firestore emulators (shipped with gcloud) and fake-gcs-server for Cloud Storage. The same code then works on Google Cloud once the emulator variables are removed.

The concepts are similar; Google Cloud stands out with its global VPC, anycast-IP load balancer, BigQuery and a reference Kubernetes (GKE).

European hosting, SecNumCloud-qualified offers, predictable pricing and open standards (OpenStack, S3, Kubernetes) that ease reversibility. The managed service catalogue is smaller: assess it against your needs.

The labs simulate the open building blocks: MinIO for the S3 API, k3d for Kubernetes and terraform test mock providers to validate Terraform code. The same commands then apply to the real Public Cloud.

OpenTofu is an open source fork of Terraform and largely compatible. The concepts and most commands in this course apply to both.

No: the labs use LocalStack (emulated AWS APIs), MinIO (S3 backend) and terraform test mock providers.

No, they complement each other: Terraform creates infrastructure (networks, VMs, managed services), Ansible configures systems and applications.