An IoT platform monitors device telemetry. 800 devices stopped reporting three weeks ago and nobody noticed. Why?

What the interviewer is testing

Whether you understand that monitoring which processes arriving data is structurally blind to data that stops arriving.

The cause

Every check operates on messages that arrive. Ingestion rate, processing latency, error rate, data quality — all of these are computed from what came in. A device that stops transmitting contributes nothing, and nothing is exactly what a healthy quiet device also contributes.

At fleet scale, 800 out of many thousands does not move the aggregate ingestion rate enough to notice.

The fix

Monitor for absence explicitly, per device, which requires a registry of what should be reporting and an expected interval per device.

Concretely: track last-seen per device; alert when a device exceeds its expected interval by a margin; and — critically — alert on the count of silent devices as an aggregate, because individually a silent device may be legitimate (powered off, seasonal, decommissioned) while 800 at once is an event.

Detect correlated silence. 800 devices going quiet together points at a common cause: a firmware update, a certificate expiry, a network provider change, a regional outage, or a backend change rejecting their protocol version. Grouping silent devices by firmware version, region, hardware revision and connectivity provider usually identifies the cause immediately.

The likely cause here

Three weeks is consistent with a credential or certificate expiry, a firmware rollout, or a backend change that rejected their messages. All three would show a step change at a specific time, which is the first thing to look for.

What a strong answer adds

Applying the same principle beyond IoT. Absence monitoring is the most commonly missing alert in every domain: the batch job that did not run, the partner feed that stopped, the queue that has no messages because the producer died. Any check that only inspects what arrived shares this blind spot.

And the registry requirement: absence monitoring is impossible without an authoritative record of what should exist, which is why fleet management is a prerequisite rather than a nicety.

Common weak answers

Adding more telemetry monitoring, which has the same blind spot. Manual periodic reviews.