Loading…
Design a Distributed Tracing and Logging System is a medium system design interview question covering log aggregation, distributed tracing, Elasticsearch, Kafka, observability — the kind asked at FAANG (Facebook/Meta, Apple, Amazon, Netflix, Google) and AI-first companies like Anthropic, OpenAI, and Nvidia.
Design an observability platform for a large microservices architecture. Engineers should be able to search logs, trace requests across services, and set up alerts in near real time.
That's it. No further details. This is intentional — your first job is to scope the problem by asking the right clarifying questions.
A practical infrastructure question that surfaces experience with production debugging. Tests whether candidates can distinguish between logs (discrete events), metrics (numeric aggregates), and traces (request flows across services). Strong candidates immediately note all three are needed and have different storage/query requirements.
Work through the Clarify phase by asking questions one at a time — just like a real interview.
Each answer reveals why that question matters and how it changes your design decisions.
Once you've clarified enough, unlock the full architecture, calculations, and trade-off analysis.
Design rounds are decided on capacity estimates. Both tools are free.
Longer written walkthroughs of the ideas behind it.
Services emit structured logs and traces (OpenTelemetry). A lightweight agent on each host ships logs and spans to Kafka. Log processors (Flink) parse, enrich, and index into Elasticsearch. Traces stored in Cassandra (optimised for trace_id lookups). A query service handles ad-hoc log search and trace graph reconstruction. Alerting via a rules engine consuming the Kafka stream. Retention tiered: hot (7d in Elasticsearch), warm (90d in S3 Parquet), cold (1yr compressed).
A full interview loop is more than one round. These are the others, each with what is on the site for it.