You’re on the SRE team at a fintech payments processor where 5,000 Linux servers handle card authorizations. A single unintended config change (e.g., TLS ciphers, firewall rules, kernel params) can cause outages or compliance violations. Your monitoring agent streams configuration snapshots to a central service, and you must continuously detect and report configuration drift.
You are given a stream of snapshot events. Each event is a tuple:
timestamp (int): seconds since epochserver_id (int)config (dict[str, str]): key/value configuration pairsYou are also given:
baseline (dict[str, str]): the desired configurationk (int): the number of most drifted servers to report after processing all eventsA server is considered drifted at time t if its latest snapshot at or before t differs from the baseline.
Define the drift score of a server as the number of keys where the latest config differs from baseline, counting:
Implement a function that processes the events in chronological order (events may be unsorted; you must handle this) and returns the k server IDs with the highest drift score after all events are applied.
Tie-breaking: If multiple servers have the same drift score, return the smaller server_id first.
Return a list of server IDs of length min(k, number_of_seen_servers), sorted by:
server_id ascendingInput:
baseline = {"a":"1","b":"2"}events = [(10, 1, {"a":"1","b":"9"}), (11, 2, {"a":"0"})]k = 2Output: [2, 1]
Explanation:
b only → score 1.a (0 vs 1) and is missing b → score 2.Input:
baseline = {"x":"on"}events = [(5, 7, {"x":"on","extra":"1"}), (3, 7, {"x":"off"})]k = 1Output: [7]
Explanation: Events are applied by timestamp: at t=3 config is {x:off} then at t=5 config is {x:on, extra:1}. Final drift is only the extra key → score 1.
1 <= len(events) <= 2 * 10^51 <= server_id <= 50001 <= len(baseline) <= 10^4config has up to 10^4 keys<= 2 * 10^51 <= k <= 5000