Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is deploying a Go-based web application to Amazon EC2 instances. The application logs HTTP requests in a custom space-delimited format to /var/log/app/web.log. The fields in each log entry are: IP, client, user, datetime, request_path, response_status, and response_time_ms. The developer wants to use the unified CloudWatch agent to publish these logs to CloudWatch Logs and then create a metric filter to track only requests that returned an HTTP 404 response status. Which two configuration steps must the developer perform to meet these requirements?

  1. In the CloudWatch agent configuration file, specify the log file path under the logs.logs_collected.files section and define a target log group.Answer
  2. Create a CloudWatch Logs metric filter on the target log group using the pattern [ip, client, user, datetime, request_path, response_status = 404, response_time_ms].Answer
  3. C
    Create a CloudWatch Logs metric filter on the target log group using the pattern { $.response_status = 404 }.
  4. D
    Create a CloudWatch Logs metric filter on the target log group using the pattern [response_status = 404].
  5. E
    In the CloudWatch agent configuration file, specify the log file path under the metrics.metrics_collected section to enable log streaming.

Answer

To monitor the space-delimited log file, the developer must configure the log file path under the logs.logs_collected.files section of the unified CloudWatch agent configuration file, and create a CloudWatch Logs metric filter with the pattern [ip, client, user, datetime, request_path, response_status = 404, response_time_ms].
To stream local log files to CloudWatch Logs, the unified CloudWatch agent must be configured with the file path in the logs.logs_collected.files section. To create a metric filter for space-delimited logs, the filter pattern must list all fields in order, enclosed in brackets, and use the assignment operator to filter on the specific HTTP status code.

Step-by-Step Solution

1
Configure the CloudWatch agent to collect the log file.
The file path /var/log/app/web.log and log_group_name are added to the logs.logs_collected.files section.
This informs the agent daemon to track the target log file and stream its content to CloudWatch Logs.
2
Create the metric filter for space-delimited events.
The metric filter is created on the target log group using the positional bracketed syntax [ip, client, user, datetime, request_path, response_status = 404, response_time_ms].
Because the logs are space-delimited rather than JSON, CloudWatch Logs maps fields positionally. Specifying the preceding fields is necessary for the filter to target the sixth field, response_status.

Key Concept

Configuring log collection with the unified CloudWatch agent and applying space-delimited metric filter patterns.
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic