Examkin

Question

Difficulty: EasyMonitoring and Analyzing Logs with Amazon CloudWatch

A developer has installed and configured the Unified CloudWatch Agent on a fleet of Amazon EC2 instances to stream application logs to Amazon CloudWatch Logs. However, after starting the agent, the developer notices that no log groups or log streams are being created in the CloudWatch console.

Which TWO actions should the developer take to troubleshoot and resolve this issue?

  1. Verify that the IAM role attached to the EC2 instances contains the permissions from the CloudWatchAgentServerPolicy AWS-managed policy.Answer
  2. Check the CloudWatch agent log file on the EC2 instances for configuration errors or AWS API credential issues.Answer
  3. C
    Verify that the Metric Filter patterns associated with the target log group match the format of the incoming logs.
  4. D
    Ensure that the application Nginx service execution timeout is configured to match the CloudWatch log streaming visibility window.
  5. E
    Modify the IAM trust policy of the EC2 instance role to allow the logs.amazonaws.com service principal to assume the role.

Answer

Verify that the IAM role attached to the EC2 instances contains the permissions from the CloudWatchAgentServerPolicy AWS-managed policy, and check the CloudWatch agent log file on the EC2 instances for configuration errors or AWS API credential issues.
The correct steps to troubleshoot missing logs in CloudWatch when using the Unified CloudWatch Agent are verifying the IAM permissions of the EC2 instance (which must include permissions to publish logs) and checking the agent's local log file for errors. The CloudWatchAgentServerPolicy contains the required permissions, and the local agent log file provides diagnostic details.

Step-by-Step Solution

1
Identify the service permissions required for the agent to publish logs.
Confirm that the EC2 instance must be allowed to perform logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, which are provided by the CloudWatchAgentServerPolicy.
Without these permissions, the agent cannot write logs to CloudWatch.
2
Locate and review the agent's local logs on the host operating system.
Check the local log file for permission denied errors or configuration errors.
Local agent logs are the primary diagnostic source when logs fail to publish to AWS.

Key Concept

CloudWatch Logs Ingestion and Troubleshooting
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic