At a SaaS company, one client session is split across several web servers, and any single server log is missing most of the URLs from that session. What is the monitoring impact?

Load balancing that spreads one client session so one server log misses most of the URLs is the impact. The same client session is divided across several web servers, so the URLs land in more than one log. Any one server's log is then an incomplete record of that session, which is what load balancing does when it does not keep the whole session on one server. A Tor overlay that hides the client behind an entry hop the web servers cannot name would hide which client was behind an entry hop. It does not split one session's URLs across the company's own web servers or explain why those servers each hold a different piece. A host firewall on the client that blocks later URLs before the requests leave the laptop would stop later requests from leaving the laptop. Blocked requests would be missing everywhere, not present on the other web servers while absent from one log. Certificate expiry that ends the session before the client requests the remaining URLs would end the session so the remaining URLs were never requested. The stem says the session continued across several servers and that one log is missing most of the URLs, which means those URLs were handled elsewhere. Exam caveat: an overlay, a client firewall, or an expired certificate would not park the missing URLs on the other web servers. The gap in this note is the session being spread. Operational check: correlate the session across the web-server logs, or use the load-balancer record, before you conclude that a URL never happened just because one server omitted it.