Domain 4: Operations and Support (22%)¶

Overview¶

This domain covers the ongoing management of cloud environments, including monitoring, logging, optimization, patching, change management, and SLA management. Operations and support require both technical knowledge and process understanding.

Monitoring¶

📖 CompTIA Cloud+ Exam Objectives - Official exam objectives for operations domain

Monitoring Types¶

Infrastructure Monitoring: - CPU utilization, memory usage, disk I/O, network throughput - Instance health status and availability - Storage capacity and performance - Network latency and packet loss - Load balancer health and distribution

Application Monitoring: - Response time and latency - Error rates and status codes - Throughput (requests per second) - Application-specific business metrics - User experience metrics (page load time, interaction time)

Network Monitoring: - Bandwidth utilization - Latency between components - Packet loss and retransmission rates - VPN tunnel status - DNS resolution time

Security Monitoring: - Authentication success and failure rates - Unauthorized access attempts - Configuration change detection - Vulnerability scan results - Compliance status and drift

Key Metrics¶

Compute Metrics: | Metric | Description | Threshold Indicators | |--------|-------------|---------------------| | CPU Utilization | Processor usage percentage | > 80% sustained = investigate | | Memory Utilization | RAM usage percentage | > 90% = risk of OOM | | Disk I/O | Read/write operations per second | Varies by storage type | | Disk Latency | Time for I/O operations | > 10ms for SSD = investigate | | Network In/Out | Data transfer rates | Approaching bandwidth limits |

Application Metrics: | Metric | Description | Threshold Indicators | |--------|-------------|---------------------| | Response Time | End-to-end request latency | P95 > SLA target | | Error Rate | Percentage of failed requests | > 1% = investigate | | Throughput | Requests per second | Below baseline = investigate | | Saturation | Resource capacity utilization | > 80% = scale soon |

Monitoring Tools¶

Cloud-Native: - AWS CloudWatch - Metrics, logs, alarms, dashboards - Azure Monitor - Metrics, logs, Application Insights - Google Cloud Monitoring - Metrics, uptime checks, alerting

Third-Party: - Datadog - Full-stack monitoring and APM - New Relic - Application performance monitoring - Prometheus + Grafana - Open source metrics and visualization - Nagios - Infrastructure monitoring - Zabbix - Network and infrastructure monitoring

Alerting Best Practices¶

• Set meaningful thresholds based on baselines, not arbitrary values
• Use warning and critical severity levels
• Implement alert routing based on severity (P1 pages on-call, P3 creates ticket)
• Avoid alert fatigue by reducing noise and false positives
• Include runbook links in alert notifications
• Implement escalation procedures for unacknowledged alerts
• Test alerts regularly to ensure they fire correctly

Logging¶

Log Types¶

Infrastructure Logs: - Operating system logs (syslog, Windows Event Log) - Hypervisor and container runtime logs - Network device logs (firewall, load balancer) - Storage system logs

Application Logs: - Application error and debug logs - Transaction logs and audit trails - Access logs (web server, API gateway) - Custom business event logs

Security Logs: - Authentication and authorization events - API call audit logs (CloudTrail, Activity Log) - Firewall and WAF logs - VPN connection logs

Audit Logs: - Configuration change logs - User administration logs - Compliance-related event logs - Resource creation and deletion logs

Centralized Logging¶

Architecture:

Sources -> Collection -> Aggregation -> Storage -> Analysis -> Visualization

Components: - Collection agents - Collect logs from sources (Fluentd, Filebeat, CloudWatch Agent) - Log aggregation - Centralize logs from multiple sources - Log storage - Indexed storage for search and retention (Elasticsearch, CloudWatch Logs) - Analysis - Query and analyze log data (Kibana, Log Insights) - Visualization - Dashboards and reports

ELK Stack (Elasticsearch, Logstash, Kibana): - Elasticsearch - Search and analytics engine - Logstash - Log collection and processing pipeline - Kibana - Visualization and dashboard platform - Beats - Lightweight data shippers

Log Retention¶

• Define retention policies based on compliance requirements
• HIPAA - 6 years minimum
• PCI-DSS - 1 year minimum (3 months immediately available)
• SOX - 7 years minimum
• GDPR - As long as necessary for purpose
• Use tiered storage for cost optimization (hot/warm/cold)
• Implement automated archival and deletion

Log Analysis¶

• Pattern matching - Search for specific error patterns
• Correlation - Link events across multiple log sources
• Trending - Identify patterns over time
• Anomaly detection - Automated identification of unusual patterns
• Root cause analysis - Trace issues back to origin

Optimization¶

Right-Sizing¶

Process: 1. Collect utilization data over 2-4 weeks minimum 2. Analyze peak, average, and idle utilization 3. Identify over-provisioned resources (< 40% average utilization) 4. Identify under-provisioned resources (> 80% average utilization) 5. Recommend appropriate instance size or type 6. Implement changes during maintenance window 7. Monitor after changes to verify performance

Considerations: - Analyze during representative time periods - Account for seasonal or periodic spikes - Consider memory-optimized, compute-optimized, or storage-optimized instances - Use burstable instances for variable workloads - Right-size in non-production first, then production

Cost Optimization¶

Pricing Models: | Model | Commitment | Discount | Best For | |-------|-----------|----------|----------| | On-demand | None | None | Variable, unpredictable workloads | | Reserved | 1-3 years | Up to 72% | Steady-state, predictable workloads | | Spot/Preemptible | None | Up to 90% | Fault-tolerant, flexible workloads | | Savings Plans | $/hour commitment | Up to 72% | Flexible commitment-based savings |

Cost Management Strategies: - Tagging - Tag all resources for cost allocation and accountability - Budgets - Set spending budgets with alerts - Scheduling - Stop non-production resources outside business hours - Storage tiering - Move data to cheaper tiers based on access patterns - Unused resources - Delete orphaned resources (unattached volumes, unused IPs, old snapshots) - Data transfer - Minimize cross-region and internet data transfer

Cost Management Tools: - AWS Cost Explorer, Azure Cost Management, GCP Billing Reports - Third-party: CloudHealth, Spot.io, Kubecost (for Kubernetes)

Performance Optimization¶

Caching: - Content Delivery Network for static assets - Application-level caching (Redis, Memcached) - Database query caching - DNS caching - API response caching

Database Optimization: - Read replicas for read-heavy workloads - Connection pooling for efficient connections - Query optimization and indexing - Partitioning and sharding for large datasets - Appropriate storage engine and instance type

Network Optimization: - CDN for global content delivery - Regional resource placement near users - Direct connect for high-bandwidth, low-latency needs - Compression for data transfer - Connection keep-alive for reduced overhead

Patching and Updates¶

Patch Management Process¶

1. Identify - Monitor for new patches and security advisories
2. Evaluate - Assess impact, criticality, and applicability
3. Test - Apply patches in non-production environment
4. Schedule - Plan deployment during maintenance window
5. Deploy - Apply patches using automated tools
6. Verify - Confirm successful application and no regressions
7. Document - Record all patching activities

Patching Strategies¶

Rolling Updates: - Patch instances one at a time or in batches - Maintain availability during patching - Rollback individual instances if issues arise - Suitable for stateless applications behind load balancers

Blue/Green Patching: - Create patched environment alongside current - Test patched environment thoroughly - Switch traffic to patched environment - Keep old environment for quick rollback

Immutable Infrastructure: - Never patch running instances - Build new images with patches applied - Replace instances with new patched images - Most reliable and repeatable approach

Automated Patching Tools¶

• AWS Systems Manager Patch Manager
• Azure Update Management
• Ansible for cross-platform patching
• OS-native tools: apt, yum, Windows Update

Patch Priority¶

Change Management¶

ITIL Change Management Process¶

Request for Change (RFC): - Description of proposed change - Business justification and impact analysis - Risk assessment and mitigation plan - Rollback procedure - Testing plan and results - Implementation schedule

Change Advisory Board (CAB): - Reviews and approves/rejects change requests - Assesses risk and business impact - Schedules changes during appropriate windows - Reviews post-implementation results - Composition: IT leadership, operations, security, business stakeholders

Change Types¶

Configuration Management¶

Configuration Management Database (CMDB): - Inventory of all configuration items (CIs) - Relationships and dependencies between CIs - Version history and change tracking - Baseline configurations for compliance - Tools: ServiceNow, BMC Helix, cloud-native resource inventories

Configuration Drift: - Deviation from desired/approved configuration - Detected through continuous compliance monitoring - Causes: Manual changes, failed automation, unauthorized access - Prevention: IaC enforcement, automated compliance scanning - Remediation: Auto-remediate or alert for manual review

SLA Management¶

SLA Components¶

Service Level Agreement (SLA): - Contract between provider and customer - Defines service commitments and penalties - Includes availability, performance, and support metrics

Service Level Objective (SLO): - Specific measurable target within an SLA - Example: 99.95% monthly availability - Internal target, may be stricter than SLA

Service Level Indicator (SLI): - Actual measurement of service performance - Example: Measured uptime was 99.97% this month - Used to track compliance with SLOs and SLAs

Availability Calculations¶

Formula: Availability = (Total Time - Downtime) / Total Time x 100

Composite Availability: - Serial components: Multiply individual availabilities - Example: 99.99% x 99.99% = 99.98% - Parallel (redundant) components: 1 - (1-A1) x (1-A2) - Example: 1 - (1-0.999) x (1-0.999) = 99.9999%

SLA Monitoring¶

• Automated tracking of SLIs against SLOs
• Dashboard visibility for all stakeholders
• Proactive alerting before SLA breach
• Monthly/quarterly SLA compliance reports
• Incident impact on SLA tracking

Capacity Management¶

Capacity Planning¶

• Forecast future resource needs based on growth trends
• Account for seasonal patterns and business events
• Plan for peak capacity plus buffer (typically 20-30%)
• Review and adjust capacity plans quarterly

Auto-Scaling¶

• Target tracking - Maintain a specific metric target (e.g., 60% CPU)
• Step scaling - Scale in/out based on alarm thresholds
• Scheduled scaling - Scale based on known patterns (business hours, events)
• Predictive scaling - ML-based prediction of future demand

Resource Quotas and Limits¶

• Cloud providers impose default limits on resources
• Monitor usage against limits
• Request limit increases proactively
• Plan architecture within quota constraints

Key Takeaways for the Exam¶

1. Know the four types of monitoring: infrastructure, application, network, security
2. Understand centralized logging architecture and retention requirements
3. Right-sizing requires data collection over representative periods
4. Know pricing models: on-demand, reserved, spot, savings plans
5. Patch management follows a defined lifecycle from identification to documentation
6. Change management has three types: standard, normal, emergency
7. Know SLA calculations - especially composite availability
8. Auto-scaling strategies: target tracking, step, scheduled, predictive