diff --git a/doc/source/internal/apimon_training/training_images/alerta_alerts_detail.png b/doc/source/internal/apimon_training/faq/faq_images/alerta_alerts_detail.png
similarity index 100%
rename from doc/source/internal/apimon_training/training_images/alerta_alerts_detail.png
rename to doc/source/internal/apimon_training/faq/faq_images/alerta_alerts_detail.png
diff --git a/doc/source/internal/apimon_training/faq/faq_images/annotations.jpg b/doc/source/internal/apimon_training/faq/faq_images/annotations.jpg
new file mode 100644
index 0000000..4481db7
Binary files /dev/null and b/doc/source/internal/apimon_training/faq/faq_images/annotations.jpg differ
diff --git a/doc/source/internal/apimon_training/faq/faq_images/dashboard_log_links.jpg b/doc/source/internal/apimon_training/faq/faq_images/dashboard_log_links.jpg
new file mode 100644
index 0000000..65d08c0
Binary files /dev/null and b/doc/source/internal/apimon_training/faq/faq_images/dashboard_log_links.jpg differ
diff --git a/doc/source/internal/apimon_training/faq/faq_images/zulip_notification_links.jpg b/doc/source/internal/apimon_training/faq/faq_images/zulip_notification_links.jpg
new file mode 100644
index 0000000..b724ee4
Binary files /dev/null and b/doc/source/internal/apimon_training/faq/faq_images/zulip_notification_links.jpg differ
diff --git a/doc/source/internal/apimon_training/faq/how_can_i_access_dashboard.rst b/doc/source/internal/apimon_training/faq/how_can_i_access_dashboard.rst
index 3014c44..c1595ba 100644
--- a/doc/source/internal/apimon_training/faq/how_can_i_access_dashboard.rst
+++ b/doc/source/internal/apimon_training/faq/how_can_i_access_dashboard.rst
@@ -1,3 +1,7 @@
 ============================
 How Can I Access Dashboard ?
 ============================ 
+
+OTC LDAP authentication is supported on
+https://dashboard.tsi-dev.otc-service.com.
+
diff --git a/doc/source/internal/apimon_training/faq/how_to_read_the_logs_and_understand_the_issue.rst b/doc/source/internal/apimon_training/faq/how_to_read_the_logs_and_understand_the_issue.rst
index e117784..834dcc0 100644
--- a/doc/source/internal/apimon_training/faq/how_to_read_the_logs_and_understand_the_issue.rst
+++ b/doc/source/internal/apimon_training/faq/how_to_read_the_logs_and_understand_the_issue.rst
@@ -1,3 +1,72 @@
 =============================================
 How To Read The Logs And Understand The Issue
 =============================================
+
+
+Logs are stored on swift OBS and they expire after ~1 week. The logs are can be
+accessed from multiple locations:
+
+  - Zulip notifications:
+
+    .. image:: faq_images/zulip_notification_links.jpg
+
+  - Alerts in Alerta
+
+    .. image:: faq_images/alerta_alerts_detail.png
+
+  - Tables in dashboards
+
+    .. image:: faq_images/dashboard_log_links.jpg
+
+The logs contain whole ansible playbook output and help to analyse the problem
+in detail.
+For example following log detail describes the failed scenario for ECS deployment::
+
+    2023-05-17 21:08:09.038955 | TASK [server_create_delete : Try connecting]
+    2023-05-17 21:08:09.485569 | localhost | ERROR
+    2023-05-17 21:08:09.485862 | localhost | {
+    2023-05-17 21:08:09.485922 | localhost |   "changed": true,
+    2023-05-17 21:08:09.485950 | localhost |   "cmd": [
+    2023-05-17 21:08:09.485984 | localhost |     "ssh",
+    2023-05-17 21:08:09.486016 | localhost |     "-o",
+    2023-05-17 21:08:09.486052 | localhost |     "UserKnownHostsFile=/dev/null",
+    2023-05-17 21:08:09.486076 | localhost |     "-o",
+    2023-05-17 21:08:09.486097 | localhost |     "StrictHostKeyChecking=no",
+    2023-05-17 21:08:09.486118 | localhost |     "linux@80.158.60.117",
+    2023-05-17 21:08:09.486138 | localhost |     "-i",
+    2023-05-17 21:08:09.486160 | localhost |     "~/.ssh/scenario2a-162b6915911748c5809474be69d2a3b3-kp.pem"
+    2023-05-17 21:08:09.486192 | localhost |   ],
+    2023-05-17 21:08:09.486221 | localhost |   "delta": "0:00:00.127394",
+    2023-05-17 21:08:09.486242 | localhost |   "end": "2023-05-17 21:08:09.454247",
+    2023-05-17 21:08:09.486262 | localhost |   "invocation": {
+    2023-05-17 21:08:09.486283 | localhost |     "module_args": {
+    2023-05-17 21:08:09.486314 | localhost |       "_raw_params": "ssh -o 'UserKnownHostsFile=/dev/null' -o 'StrictHostKeyChecking=no' linux@80.158.60.117 -i ~/.ssh/scenario2a-162b6915911748c5809474be69d2a3b3-kp.pem",
+    2023-05-17 21:08:09.486373 | localhost |       "_uses_shell": false,
+    2023-05-17 21:08:09.486397 | localhost |       "argv": null,
+    2023-05-17 21:08:09.486428 | localhost |       "chdir": null,
+    2023-05-17 21:08:09.486455 | localhost |       "creates": null,
+    2023-05-17 21:08:09.486487 | localhost |       "executable": null,
+    2023-05-17 21:08:09.486513 | localhost |       "removes": null,
+    2023-05-17 21:08:09.486533 | localhost |       "stdin": null,
+    2023-05-17 21:08:09.486553 | localhost |       "stdin_add_newline": true,
+    2023-05-17 21:08:09.486573 | localhost |       "strip_empty_ends": true,
+    2023-05-17 21:08:09.486593 | localhost |       "warn": false
+    2023-05-17 21:08:09.486613 | localhost |     }
+    2023-05-17 21:08:09.486633 | localhost |   },
+    2023-05-17 21:08:09.486657 | localhost |   "msg": "non-zero return code",
+    2023-05-17 21:08:09.486689 | localhost |   "rc": 255,
+    2023-05-17 21:08:09.486713 | localhost |   "start": "2023-05-17 21:08:09.326853",
+    2023-05-17 21:08:09.486734 | localhost |   "stderr": "Pseudo-terminal will not be allocated because stdin is not a terminal.\r\nWarning: Permanently added '80.158.60.117' (ED25519) to the list of known hosts.\r\nlinux@80.158.60.117: Permission denied (publickey).",
+    2023-05-17 21:08:09.486755 | localhost |   "stderr_lines": [
+    2023-05-17 21:08:09.486776 | localhost |     "Pseudo-terminal will not be allocated because stdin is not a terminal.",
+    2023-05-17 21:08:09.486808 | localhost |     "Warning: Permanently added '80.158.60.117' (ED25519) to the list of known hosts.",
+    2023-05-17 21:08:09.486834 | localhost |     "linux@80.158.60.117: Permission denied (publickey)."
+    2023-05-17 21:08:09.486855 | localhost |   ]
+    2023-05-17 21:08:09.486875 | localhost | }
+
+In this case it seems that deployed ECS doesn't contain injected public SSH key
+which can point to issue with cloud init or metadata server.
+
+The playbooks can be run also manually on any OTC tenant and can be used
+for further investigation and analysis.
+
diff --git a/doc/source/internal/apimon_training/faq/what_are_the_annotations.rst b/doc/source/internal/apimon_training/faq/what_are_the_annotations.rst
index d64b1f6..88d89fe 100644
--- a/doc/source/internal/apimon_training/faq/what_are_the_annotations.rst
+++ b/doc/source/internal/apimon_training/faq/what_are_the_annotations.rst
@@ -1,3 +1,23 @@
 #########################
 What Are The Annotations?
 #########################
+
+
+Annotations provide a way to mark points on the graph with rich events. When you
+hover over an annotation you can get event description and event tags. The text
+field can include links to other systems with more detail.
+
+.. image:: faq_images/annotations.jpg
+
+
+In Cloudmon Dashboards annotations are used to show the JIRA change issue types
+which change the transition from SCHEDULED to IN EXECUTION. This helps to
+identify if some JIRA change has negative impact on platform in real time. The
+annotations contain several fields which help to corelate the platform behaviour
+with the respective change directly on the dashboard:
+
+ - JIRA Change issue ID
+ - Impacted Availability Zone
+ - Affected Environment 
+ - Main component
+ - Summary
\ No newline at end of file