Read the Trace: Spans, Waterfalls & What They Confess

29 questions

A distributed trace is a picture of one request's life across every service it touched. Once you can read the shape, the bug is often obvious before you open a single log line. This quiz shows you span waterfalls and asks what went wrong: the staircase, the straggler, the retry storm, the clock skew, the broken handoff. It closes with the sampling tradeoffs that decide whether the trace you need survives long enough to be read.

Start

Questions

Not answered. In a trace waterfall, what does it mean when Span B is drawn nested inside Span A, indented and starting after A begins?
Not answered. The root span of a trace lasts 800 ms. Its two direct children last 150 ms and 200 ms. What can you conclude about the other 450 ms?
Not answered. What does it usually mean when a parent span is much wider than its one child span, with large gaps of unexplained time on both sides of the child?
Not answered. What could explain a visible gap in time between two sibling spans that share the same parent, when nothing else appears in the trace during that gap?
Not answered. Why might a trace waterfall and a service's log timestamps disagree about when something happened?
Not answered. What is the difference between a span attribute and a span event?
Not answered. What does it usually mean when a parent span contains many identical, same-duration child spans running one after another, filling most of the parent's time?
Not answered. Two traces for the same endpoint and the same code path look very different: one shows a staircase of several database queries, the other shows a single short span. What's the most likely explanation?
Not answered. The three child spans below have no data dependency on each other. None of their inputs come from another's output. Yet the trace shows them running one after another instead of at the same time. What's happening?
Not answered. After fixing the serialized-awaits problem above by starting all three calls before awaiting any of them, what should the new trace's parent duration be closest to?
Not answered. A fan-out to five independent services: four return in about 50 ms, one takes 310 ms. The parent span's duration is 310 ms wide. Why?
Not answered. A parent span fans out to many independent children and waits for all of them to finish (a join). Which of these statements are true?
Not answered. The waterfall shows the same child span repeated several times, each with a longer gap before the next one than the last. What does this pattern usually mean?
Not answered. A child span appears to start 30 ms before its parent span starts, even though the service that produced the child is healthy and its own logs show it started only after receiving the request. What's the most likely explanation?
Not answered. You expect a trace to continue from checkout-api into shipping-service, but instead the trace simply ends at checkout-api, and a completely separate trace starts fresh inside shipping-service at roughly the same moment. What's the most likely cause?
Not answered. Which of the following, seen in a tracing system, are signs of broken context propagation somewhere in the request path?
Not answered. A span named resize-image takes 480 ms out of a 500 ms parent. A developer says 'image resizing must be really slow.' Looking at the code, the resize-image span actually wraps both the resize operation and a network upload of the result. What does this teach about reading a span's duration?
Not answered. The http.request span ends at 120 ms, but a send-email span for the same request starts at 150 ms, drawn off to the side and connected by a link rather than nested inside the request span. What does this shape usually represent?
Not answered. Which of the following would make you suspect a span represents async handoff work, rather than blocking work the parent waited on?
Not answered. Six database query spans in the same trace each show the same pattern: a long, uniform stretch of waiting before the query actually runs, followed by a short burst of real work. What does the uniform wait at the head of every span suggest?
Not answered. A team samples 1% of traces with head-based sampling, and wants to keep every trace for a specific customer id. They add that filter to the sampler. Why does this often fail to work as intended?
Not answered. What is the main cost of tail-based sampling, which decides whether to keep a trace only after the trace has completed?
Not answered. During an incident review, someone says 'we have no traces for the outage.' What is the most likely underlying reason?
Not answered. You need to know how often a particular error code occurred across all traffic over the past week, aggregated by hour. Which telemetry type is best suited to answer this directly?
Not answered. A request's user id is fine to attach as a span attribute, but would be dangerous to use as a metric label. Which of these explain why?
Not answered. Which of these questions would you best answer by reading an individual trace, rather than by using metrics or logs?
Not answered. A parent span fans out to 5 independent downstream calls. Each call independently has a 2% chance of being the slow straggler for that request (that is, a 98% chance of finishing within its own p99 threshold). Assuming independence, what is the probability, as a whole number of percent, that at least one of the 5 calls is the straggler?
Not answered. A trace shows three independent calls made serially, one after another: 120 ms, 260 ms, and 90 ms, for a parent duration of 470 ms. If these were fixed to run in parallel instead, roughly how many milliseconds would the parent's duration shrink by?
Not answered. A fan-out parent waits on 4 independent children with durations 45 ms, 52 ms, 310 ms, and 60 ms. Assuming the parent does no other work of its own and simply waits for all four to finish, what is the parent span's duration, in milliseconds?