Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A legacy web application deployed on an Amazon EC2 instance writes log events in a space-delimited format to `/var/log/web-app/access.log`. The fields in the log are ordered as: `ip`, `user`, `date`, `request`, `status_code`, and `bytes`. A developer installs the unified CloudWatch agent on the instance to stream these logs to Amazon CloudWatch Logs and configures a metric filter to count the occurrences of HTTP 5xx server errors. However, after starting the agent, no log events appear in the CloudWatch Logs console. In addition, during testing, the metric filter fails to match any log events representing server errors. Which two actions should the developer take to resolve these issues? (Select TWO.)

  1. Ensure the IAM role attached to the EC2 instance profile contains permissions to perform `logs:CreateLogStream` and `logs:PutLogEvents` operations.Answer
  2. Update the metric filter pattern to `[ip, user, date, request, status_code >= 500 && status_code < 600, bytes]` to match status codes in the 5xx range.Answer
  3. C
    Update the metric filter pattern to `[ip, user, date, request, status_code = 5*, bytes]` to catch all status codes starting with 5.
  4. D
    Store static AWS Access Key ID and Secret Access Key credentials in the CloudWatch agent's local credentials configuration file on the EC2 instance.
  5. E
    Migrate the application to AWS Lambda and configure the function timeout to 30 minutes to allow the agent to run continuously without interruption.

Answer

Ensure the IAM role attached to the EC2 instance profile contains permissions to perform `logs:CreateLogStream` and `logs:PutLogEvents` operations, and update the metric filter pattern to `[ip, user, date, request, status_code >= 500 && status_code < 600, bytes]`.
To resolve the log streaming issue, the EC2 instance profile's IAM role must have the necessary permissions (`logs:CreateLogStream` and `logs:PutLogEvents`) to interact with CloudWatch Logs. To resolve the metric filter issue for space-delimited log files, the filter must use valid bracket syntax and standard numeric comparison operators (`status_code >= 500 && status_code < 600`) to correctly capture the 5xx HTTP status code range.

Step-by-Step Solution

1
Diagnose why logs are not appearing in CloudWatch Logs by checking IAM permissions.
The CloudWatch agent requires explicit write permissions via the EC2 instance profile. Granting `logs:CreateLogStream` and `logs:PutLogEvents` enables log streaming.
Without these permissions, the agent cannot authenticate or write logs to the CloudWatch API.
2
Analyze the log format and construct a valid metric filter pattern for space-delimited logs.
The correct filter pattern is `[ip, user, date, request, status_code >= 500 && status_code < 600, bytes]`.
Space-delimited filters require brackets mapping to the fields, and numeric ranges must be specified with logical AND (`&&`) rather than wildcards (`*`).

Key Concept

CloudWatch Agent IAM Permissions and Space-Delimited Metric Filter Syntax
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic