At a SaaS company, syslog on a border router starts repeating the same hardware fault. The on-call team wants a page when that message returns. Which alert fits?
Select an answer to reveal the explanation.
Short Explanation
When the same bell keeps ringing, you tie the page to that bell. You want a syslog-based alert so the hardware fault pages you when it repeats. A laptop CPU rule, a dashboard with no rule, or a capacity folder will not make that call for you.
Full Explanation
Syslog on the border router is already repeating the same hardware fault, so the alert that matches is a syslog-based alert that pages when that fault repeats. The on-call team asked to be notified when the message returns, and the message itself is the network-condition evidence. An end-user CPU alert on laptops that reach the SaaS application watches user devices. Those laptops can be busy or idle with no relationship to a hardware fault on the border router, so the CPU rule neither detects the syslog message nor clears it. A syslog dashboard that shows the hardware message gives the team a place to look, but with no alert rule behind the view the repeating line never becomes a page. A capacity project that files the fault for a later review may be useful planning, yet it does not page anyone when the message returns, so it misses the operational ask. On the exam, a log view is not an alert until a rule fires on the message, and a user-device CPU rule is the wrong signal for a router hardware fault. In production, confirm the syslog alert pages when the hardware message repeats and clears when the message stops, using the same router log the team was reading.