Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is deploying a Java application on Amazon EC2 instances. The application writes log entries to a local log file at `/var/log/myapp/app.log`. The developer installs the Unified CloudWatch Agent on the instances and configures it to stream these logs to Amazon CloudWatch Logs. After starting the agent service on the EC2 instances, the developer notices that no log groups or log streams are created in CloudWatch Logs, and no log data is received. Which of the following could be the reasons for this issue? (Select TWO.)

  1. The IAM role attached to the EC2 instances does not have the permissions required to create log groups, log streams, and write log events (such as the permissions provided by the CloudWatchAgentServerPolicy managed policy).Answer
  2. The Unified CloudWatch Agent configuration file contains a syntax error or specifies an incorrect log file path under the logs section in the collect_list.Answer
  3. C
    The metric filter pattern defined in the agent configuration file incorrectly uses { .status = "ERROR" } instead of { .status == "ERROR" }, which causes the agent to fail to start.
  4. D
    The IAM role's trust policy designates lambda.amazonaws.com as the trusted entity instead of ec2.amazonaws.com, preventing the EC2 instances from assuming the role.
  5. E
    The EC2 instances are located in a public subnet, but logs cannot be uploaded because the subnet does not have a NAT Gateway or a VPC endpoint for CloudWatch Logs.

Answer

The correct reasons are that the IAM role attached to the EC2 instances lacks the required permissions (such as those in the CloudWatchAgentServerPolicy managed policy) and that the agent configuration file contains a syntax error or a misconfigured log file path under the collect_list settings.
The correct reasons are that the IAM role attached to the EC2 instances lacks the required permissions (such as those in the CloudWatchAgentServerPolicy managed policy) to communicate with CloudWatch Logs, and that the agent configuration file contains a syntax error or a misconfigured log file path under the collect_list settings, which prevents the agent from locating or processing the log files.

Step-by-Step Solution

1
Analyze the IAM permissions for the Unified CloudWatch Agent.
Identify that the agent requires permissions like `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` to write logs, which are typically provided by attaching the `CloudWatchAgentServerPolicy` managed policy to the EC2 instance profile.
Without these permissions, the agent cannot authenticate or perform log upload actions to CloudWatch Logs.
2
Check the local configuration file of the CloudWatch Agent.
Determine that the agent relies on the local configuration file (often `amazon-cloudwatch-agent.json`) to know which log files to collect and publish under the `logs` section. A syntax error or incorrect path there prevents the agent from finding or parsing the logs.
If the configuration file is malformed, the agent daemon cannot parse the settings to identify which logs to stream.
3
Evaluate the distractors regarding trust policies, metric filters, and network paths.
Confirm that metric filters are evaluated on the CloudWatch service side (not by the local agent), trust policies must allow EC2 (not Lambda) to assume the role, and public subnets do not require a NAT Gateway or VPC endpoints.
This rules out incorrect options and clarifies standard EC2 and CloudWatch Logs setup.

Key Concept

Configuring the Unified CloudWatch Agent to stream logs from EC2 instances requires both a valid configuration file on the host and an IAM role with the correct permissions (like CloudWatchAgentServerPolicy) and trust policy (ec2.amazonaws.com).
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic