Monitoring Vault Environments

You want to prevent audit logs from being written to a specific device if the disk is full. What happens to Vault?

Where are audit logs physically stored if the 'file' audit device is configured?

An operator is configuring Vault Enterprise to send audit logs to a syslog server. The operator wants to ensure that audit logs are not lost if the syslog server becomes temporarily unavailable. Which configuration parameter should be adjusted to allow Vault to buffer audit logs in memory until the syslog server is reachable?

To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?

A Vault Enterprise operator is investigating a sudden increase in memory usage on a Vault node. They suspect that a large number of leases are accumulating. Which telemetry metric should they examine to track the total number of active leases in the cluster?

Which THREE conditions might result in a Vault node becoming unhealthy?

You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?

Which telemetry type is most effective for monitoring the 'lease' count in Vault?

Which TWO factors contribute to the size and performance of Vault audit logs?

Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?

How can you view the currently enabled audit devices in a Vault cluster?

A Vault Enterprise cluster is configured with a file audit device. An operator notices that audit log entries are being written to disk, but the Vault server's memory usage is steadily increasing. They suspect that audit log buffering is causing the issue. Which configuration parameter directly controls the maximum number of audit log entries that can be buffered in memory before being flushed to the audit device?

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?

A Vault Enterprise operator is configuring telemetry to be sent to a Prometheus server. They want to ensure that metrics are retained for at least 24 hours to allow for trend analysis. Which configuration parameter in the telemetry stanza controls the length of time that Prometheus metrics are retained in memory?

A Vault Enterprise cluster is experiencing intermittent performance issues. The operations team has enabled telemetry and is collecting metrics via StatsD. They notice that the `vault.runtime.alloc_bytes` metric is steadily increasing over several days without a corresponding increase in active tokens or leases. What is the most likely explanation for this trend?

Which THREE types of metrics are collected by Vault's telemetry system?

A Vault Enterprise cluster with integrated storage (Raft) is experiencing intermittent performance degradation. The operator observes that the 'vault_raft_leader_lastContact' metric frequently spikes above 500 ms. Which underlying issue is most likely indicated by this metric behavior?

What does the 'vault_core_seal_setup_duration' metric represent?

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

Which tool is commonly used to view Vault metrics in a graphical format?

A junior operator notices that the standby nodes in a three-node Vault Enterprise cluster report a sealed status after a planned restart, while the active node is unsealed. They want to confirm cluster readiness before adding the nodes back to the load balancer. Which endpoint should they query on each node to determine seal status and standby state programmatically?