What method helps monitor forwarders and collection agents and detect silent sources within five minutes?

• A. Create a notification in Cloud Monitoring using a metric-absence condition (sample policy) per collector_id.
• B. Create a SecOps SIEM dashboard showing ingestion metrics for log_type and collector_id.
• C. Create an ingestion notification for health metrics in Cloud Monitoring based on total ingested log count per collector_id.
• D. Create a Looker dashboard querying BigQuery ingestion metrics schema.

Answer: (A)

Metric-absence alerting in Cloud Monitoring is the right approach here. By creating a notification that uses a metric-absence condition for the ingestion metric and scoping it per collector_id, you’re specifically watching for the lack of data from each forwarder or collection agent. Setting the window to five minutes means you’ll be alerted the moment a collector stops sending logs, signaling a silent source within a very tight timeframe. This directly detects missing data rather than just low volumes, which is what you need to quickly identify issues with forwarders.

Dashboards or BI views (like those showing ingestion counts or health metrics) are useful for visibility, but they don’t automatically alert you when data stops flowing. A Looker/BigQuery approach likewise centers on visualization and analysis, not real-time absence detection. The metric-absence method provides the fastest, most reliable signal for silent sources.