In monitoring, what is the benefit of a metric-absence alert for critical Windows server logs?

• A. It reduces the volume of alerts by ignoring low-severity events.
• B. It identifies all missing events within a timeframe.
• C. It notifies when expected logs stop arriving, indicating potential ingestion failure.
• D. It triggers only on high-frequency spikes.

Answer: (C)

A metric-absence alert is about detecting when expected log data stops arriving. For critical Windows server logs, that matters because if the log forwarder or ingestion path fails, you can lose visibility into security events and operational issues. The alert fires when no logs are received within a defined window, letting you quickly investigate potential ingestion failures, misconfigurations, or network problems before silence hides a real incident. This directly addresses the risk of missing data, which is the core benefit of using an absence-based alert. The other options describe different behaviors—reducing alert volume by filtering low-severity events, attempting to identify every missing event, or reacting to high-frequency spikes—that don’t capture the essential problem of a broken data path.