Monitoring Vault Environments practice questions

vault server reload

Why it fails: Reloading the server does not trigger log rotation.

vault operator seal

Why it fails: This seals the vault.

vault log rotate

Why it fails: This command does not exist.

The audit device is in a blocked state.

Why it fails: Audit devices go to a 'fail-closed' state, halting requests, not just missing logs.

Vault is running in dev mode.

Why it fails: Dev mode still logs to stdout, and audit logs are enabled by default in some versions.

The audit log rotation policy is set to delete logs immediately.

Why it fails: Rotation policies only handle file management, not event filtering.

telemetry { prometheus_retention_time = "30s" }

Why it fails: This setting is not valid for the telemetry stanza.

telemetry { prometheus_retention_time = "24h" }

Why it fails: This setting is not valid for the telemetry stanza.

telemetry { prometheus_retention_time = "10s" }

Why it fails: This setting is not valid for the telemetry stanza.

Vault is in recovery mode.

Why it fails: Recovery mode does not affect audit log redaction.

You are not logged in as a root user.

Why it fails: Permissions do not affect log content redaction.

The log level is set to 'info'.

Why it fails: Log levels control verbosity, not redaction.

vault.core.token.create

Why it fails: This is too narrow to identify global CPU issues.

vault.audit.request

Why it fails: Audit metrics track logging activity.

vault.storage.read

Why it fails: Storage metrics identify I/O issues, not necessarily CPU load.

To control the frequency of metric exports.

Why it fails: Metric export frequency is controlled by other parameters.

To define how long Vault keeps metrics in memory.

Why it fails: Vault does not hold metrics for long-term retention.

To tell Prometheus how long to store Vault's data.

Why it fails: Vault does not configure Prometheus retention.

Splunk

Why it fails: Splunk is an log analysis tool, not a telemetry sink.

Nagios

Why it fails: Nagios is a monitoring system, not a telemetry exporter/sink.

ELK Stack

Why it fails: ELK is used for log analysis.

database

Why it fails: Database is not a built-in audit device type.

socket

Why it fails: Socket is not a standard audit device type.

stdout

Why it fails: Stdout is not a distinct audit device type.

Manual log rotation cron job.

Why it fails: Vault manages its own rotation.

UI access restricted to local IP only.

Why it fails: This is a network security policy, not a monitoring requirement.

Debug mode enabled on all nodes.

Why it fails: Debug mode is for troubleshooting, not standard production.

The server's CPU load at the time of request.

Why it fails: System metrics are not recorded in audit logs.

The client's IP address.

Why it fails: IP addresses are not stored in audit logs by default.

vault.standby.token.count

Why it fails: vault.standby.token.count does not exist as a standard Vault telemetry metric. Vault does not expose a per-standby token count metric, and performance standbys do not maintain an independent token count that would be useful for cluster-wide monitoring. Relying on this metric would yield no data or misleading results, making it incorrect for the stated goal.

vault.core.active_token_count

Why it fails: vault.core.active_token_count is not a valid Vault telemetry metric. Vault does not expose token counts under the core namespace with that name. Using an invalid metric name would result in no data being returned, and the team would incorrectly conclude that token monitoring is unavailable. The correct metric is in the token namespace, not core.

vault.identity.num_entities

Why it fails: vault.identity.num_entities tracks the number of identity entities, not client tokens. Entities represent distinct users or applications, while tokens are authentication artifacts that can be multiple per entity. Monitoring entities would not provide the total token count and would miss tokens created without associated entities, so it fails to answer the requirement.

vault.raft.commitTime

Why it fails: vault.raft.commitTime measures the time it takes to commit a Raft log entry. While high commit times can indicate performance degradation, it does not directly signal quorum loss or follower lag. A leader with quorum might have high commit times due to slow disk, but that is different from losing quorum. This metric is useful for performance monitoring but not the primary indicator for the stated conditions.

vault.raft.storage.snapshot.size

Why it fails: vault.raft.storage.snapshot.size tracks the size of Raft snapshots. While large snapshots can indicate storage growth, they do not directly reflect quorum health or follower lag. A cluster could have a large snapshot but still have a healthy quorum, or a small snapshot with a lost quorum. This metric is more relevant for capacity planning than for detecting quorum or lag issues.

vault.raft.storage.log.entries

Why it fails: vault.raft.storage.log.entries represents the number of entries in the Raft log. While a growing log can indicate issues, it does not directly signal quorum loss or follower lag. A leader with quorum can still have a large log, and a follower that is behind may not show a high entry count if it is not receiving updates. This metric is not the most direct indicator for the specified failure modes.

The 'hmac_accessor' setting in the audit device stanza.

Why it fails: The 'hmac_accessor' setting determines whether accessor values are HMAC-hashed in audit logs. It does not control whether a mount's requests are logged. A misconfiguration here would alter the representation of accessors, not suppress audit entries entirely. Thus, it is irrelevant to the missing audit entries for a specific mount.

The 'audit_non_hmac_response_keys' parameter in the audit device configuration.

Why it fails: This parameter controls which response data fields are excluded from HMAC hashing, not whether a mount's requests are audited at all. It does not filter by mount. Even if misconfigured, it would affect the content of logged entries, not whether they are written. Therefore, it cannot explain the complete absence of audit entries for one mount while others log normally.

The 'log_raw' option in the audit device configuration.

Why it fails: The 'log_raw' option, when enabled, logs raw data without HMAC hashing. It affects the content and security of audit logs but does not filter by mount. Even if enabled or disabled, it would not cause a single mount's audit entries to be omitted while others are logged. This option is about data sensitivity, not audit scope.

vault_token_count

Why it fails: 'vault_token_count' is not a standard Vault telemetry metric. Vault exposes metrics like 'vault_token_create' and 'vault_token_revoke' for token operations, but not a direct count of active tokens. Monitoring token creation and revocation rates can help estimate active tokens, but they do not provide a real-time count. Therefore, this metric does not exist and cannot be used for alerting.

vault_core_unseal

Why it fails: 'vault_core_unseal' indicates whether the Vault node is unsealed (1) or sealed (0). It is a health metric, not related to token counts. Alerting on this would notify about seal status changes, not token limits. It does not track active tokens, so it is not suitable for the administrator's goal of monitoring token usage against a licensed limit.

vault_lease_count

Why it fails: 'vault_lease_count' tracks the number of active leases, which include tokens and other secrets. While tokens are a type of lease, this metric aggregates all leases, making it less specific for token monitoring. It could be used as a proxy, but it does not isolate tokens, and other leases might skew the count. For precise token tracking, a token-specific metric is preferable.

Enable the Prometheus telemetry endpoint and create an alert on the raft_apply metric.

Why it fails: The raft_apply metric measures the time taken to apply a Raft log entry to the state machine, not the index gap between followers and the leader. It does not expose follower lag directly. Creating an alert on raft_apply would notify on application latency, which does not reliably indicate that a follower is behind by 100 entries.

Enable the syslog audit device on each node and alert on entries containing 'raft' with a log level of WARN.

Why it fails: Audit devices record API requests and responses, not internal Raft replication metrics or log index positions. Raft follower lag is not written to audit logs as a structured field. While Vault may emit some operational logs, relying on syslog for precise index-lag thresholds is unreliable and does not provide the required numeric comparison.

Query the /v1/sys/health endpoint and alert if any node reports sealed.

Why it fails: The /v1/sys/health endpoint returns seal status, initialization state, and basic cluster health, but it does not expose Raft log indexes or follower lag. A node can be unsealed and healthy while its Raft log is significantly behind the leader. This endpoint cannot detect the 100-entry lag condition described.

Configure the 'telemetry' stanza with 'prometheus_retention_time' and enable 'unauthenticated_metrics_access'.

Why it fails: 'prometheus_retention_time' controls how long metrics are retained in memory, and 'unauthenticated_metrics_access' allows unauthenticated access to the metrics endpoint. Enabling the latter would actually reduce security by permitting unauthenticated scrapes. This is the opposite of requiring authentication. Thus, this configuration does not achieve the goal of securing the endpoint with TLS and authentication.

Use the 'vault operator diagnose' command to enable TLS and authentication for the metrics endpoint.

Why it fails: 'vault operator diagnose' is a troubleshooting command that checks the health and configuration of a Vault node. It does not configure TLS or authentication for the metrics endpoint. It is used for diagnostics, not for modifying security settings. Therefore, this command cannot achieve the required security configuration.

Enable the 'prometheus' telemetry stanza and set 'disable_hostname' to true.

Why it fails: The 'prometheus' telemetry stanza enables the Prometheus metrics endpoint, and 'disable_hostname' controls whether hostnames are included in metrics. Neither of these settings provides TLS or authentication. They are related to metric formatting and labeling, not security. Therefore, this configuration does not meet the requirement of securing the endpoint with TLS and authentication.

vault.core.active_tokens

Why it fails: There is no metric named `vault.core.active_tokens` in Vault's telemetry. The correct metric for active tokens is `vault.token.count`. This option is a plausible-sounding but incorrect metric name. Administrators should refer to the official Vault telemetry documentation for the accurate list of metrics. Using a non-existent metric would result in no data and failed monitoring.

vault.expire.num_leases

Why it fails: The `vault.expire.num_leases` metric counts the total number of leases across all secret engines, not just tokens. While tokens have leases, this metric includes leases for dynamic secrets, service accounts, and other lease-based resources. It does not isolate token counts, so it would overcount if used for token monitoring. Administrators needing token-specific data should not rely on this metric.

vault.identity.num_entities

Why it fails: The `vault.identity.num_entities` metric tracks the number of identity entities, not tokens. Entities represent distinct users or applications, and a single entity can have multiple tokens. This metric is useful for monitoring identity store growth but does not provide token counts. Therefore, it is not suitable for tracking active tokens. Using it would give a misleadingly low number.

Enable the audit device with the API using a root token, then delete the root token to make the device permanent.

Why it fails: Devices enabled through sys/audit are stored in the cluster's configuration and can be disabled by any token holding sudo on that path, regardless of whether the original root token still exists. Deleting the root token does not freeze the configuration, so this approach provides no protection against a privileged operator turning logging off, and it fails the durability requirement.

Configure the audit device to write to a remote syslog target over TCP so entries are shipped off-host immediately.

Why it fails: Shipping to a remote collector is a sound defence-in-depth measure, but Vault's logging behaviour remains fail-closed: if the TCP target is unreachable, requests fail until the device is fixed. More importantly, a remote destination does not by itself prevent an operator from disabling the device through the API, so it does not meet the tamper-resistance objective on its own.

Set audit_non_hmac_request_keys to include all parameters so request bodies can be replayed for forensic review.

Why it fails: This setting controls which request parameters are left in plaintext instead of being HMAC-SHA256 hashed, so it changes log detail and potential sensitive data exposure. It has no bearing on whether devices can be disabled or whether coverage spans the cluster, and expanding plaintext logging can actually violate the compliance goal by writing secrets to disk.

Enable the audit device's log_raw option and parse the request paths from the audit log to correlate latency.

Why it fails: log_raw disables HMAC hashing of sensitive values, which exposes plaintext secrets and parameters in the log. While the audit log does contain request paths useful for correlation, the setting degrades security and provides no timing data of its own, so it cannot attribute latency to a mount. It also risks leaking credentials, making it an inappropriate diagnostic step.

Query the /v1/sys/health endpoint of each node and compare the returned performance_standby and replication_dr fields to identify the slow mount.

Why it fails: The health endpoint reports seal status, standby state, replication mode, and server version; it carries no per-request or per-mount timing information. Comparing performance_standby and replication_dr flags across nodes tells you about cluster topology, not which secrets engine is slow. Relying on it here would send the investigation down the wrong path entirely.

Enable per-mount metrics by configuring the mount with the appropriate telemetry option, then compare vault.secrets.kv or engine-specific latency series across mounts.

Why it fails: Vault does not offer a per-mount telemetry toggle that emits distinct latency series for each mount path. Metrics such as vault.core.handle_request are aggregated at the core level, so this configuration option does not exist and would not isolate the offending engine even if attempted. The premise of enabling per-mount metrics is technically incorrect for Vault Enterprise.

vault.barrier.get

Why it fails: The `vault.barrier.get` metric measures the time taken for read operations at the barrier layer, which is a lower-level encryption layer. While it can indicate storage performance, it does not directly measure the storage backend latency (e.g., Consul or Raft). It is more about encryption/decryption overhead. Therefore, it is not the best metric for diagnosing backend storage latency, though it may provide supplementary information.

vault.raft.leader.lastContact

Why it fails: The `vault.raft.leader.lastContact` metric indicates the time since the leader last contacted a follower, which is useful for monitoring Raft cluster health. However, it does not measure storage backend latency or request processing time. It is specific to the Raft consensus protocol and would not help diagnose general storage performance issues outside of Raft. This metric is not relevant to the operator's goal.

vault.rollback.attempt

Why it fails: The `vault.rollback.attempt` metric counts the number of rollback attempts for leases. While rollbacks can impact performance, this metric does not measure latency or request processing time. It is a counter of events, not a timing metric. Examining it might reveal rollback frequency, but it would not directly diagnose storage backend latency or request processing bottlenecks.