What is the difference between monitoring and observability?
Understand monitoring vs observability: how known-unknowns differ from unknown-unknowns, the three pillars, and where Prometheus fits in the stack.
Expected Interview Answer
Monitoring is watching a system against a known set of predefined metrics and alerts to answer whether it is healthy, while observability is the property of being able to ask arbitrary new questions about a system's internal state from its external outputs — metrics, logs, and traces.
Monitoring answers the known-unknowns: you decide in advance what to measure (CPU, error rate, latency) and alert when thresholds break. Observability targets the unknown-unknowns: when something novel happens, rich, high-cardinality telemetry lets you slice and correlate data to explain why, without shipping new instrumentation first. Monitoring is a subset of what an observable system enables; Prometheus provides the metrics pillar, while logs and traces complete the picture.
- Monitoring gives fast, cheap alerting on known failure modes
- Observability enables debugging of novel, unpredicted problems
- Together they cover both known and unknown issues
- High-cardinality data supports deep root-cause analysis
- Correlating metrics, logs, and traces shortens incident resolution
AI Mentor Explanation
Monitoring is the scoreboard showing runs, wickets, and overs — the fixed numbers everyone agreed to track. Observability is having every ball's line, length, speed, and field placement recorded, so that when a batting collapse happens unexpectedly, an analyst can dig in and explain exactly which deliveries and shot choices caused it, not just that the score dropped.
Step-by-Step Explanation
Step 1
Define known metrics
Monitoring starts by choosing signals like latency, errors, and saturation to watch continuously.
Step 2
Set thresholds and alerts
Alerts fire when a known metric breaches a boundary you predefined.
Step 3
Emit rich telemetry
Observability requires instrumenting metrics, logs, and traces with high-cardinality context.
Step 4
Explore, don't just watch
When a novel issue appears, query and correlate telemetry to answer new questions ad hoc.
Step 5
Correlate the three pillars
Join a spiking metric to related logs and traces to isolate root cause quickly.
What Interviewer Expects
- Monitoring = known-unknowns, observability = unknown-unknowns
- The three pillars: metrics, logs, traces
- Understanding that monitoring is a subset outcome of observability
- Role of high-cardinality data
- Where Prometheus fits (the metrics pillar)
Common Mistakes
- Treating the two terms as synonyms
- Claiming metrics alone make a system observable
- Ignoring logs and traces entirely
- Thinking observability replaces monitoring rather than extending it
Best Answer (HR Friendly)
“Monitoring is like a set of warning lights that tell you when something you expected to break has broken. Observability is having enough detailed information to investigate and explain problems you never saw coming. You need both to keep systems reliable.”
Code Example
# Alert when error ratio exceeds 5%
sum(rate(http_requests_total{status=~"5.."}[5m]))
/
sum(rate(http_requests_total[5m])) > 0.05Follow-up Questions
- What are the three pillars of observability?
- Why is high-cardinality data important for observability?
- Which pillar does Prometheus cover, and what covers the rest?
- Can a system be monitored but not observable?
- How do traces complement metrics during an incident?
MCQ Practice
1. Which best describes observability?
Observability is the ability to explore a system's internal state through its outputs, including questions not planned in advance.
2. Which is NOT one of the three pillars of observability?
The three pillars are metrics, logs, and traces; firewalls are a security control, not a telemetry pillar.
3. Which pillar does Prometheus primarily provide?
Prometheus is a metrics system; logs and traces come from other tools like Loki and Jaeger.
Flash Cards
What does monitoring answer? — Known-unknowns — whether predefined signals have crossed thresholds.
What does observability answer? — Unknown-unknowns — arbitrary new questions about internal state from telemetry.
Name the three pillars. — Metrics, logs, and traces.
Is monitoring part of observability? — Yes — monitoring is one outcome an observable system enables.