An application runs on Amazon EC2 instances and writes log events to a local file at /var/log/app/current.log. The logs are rotated hourly and renamed with a timestamp suffix, after which a new current.log file is created. The CloudWatch agent is configured to collect these logs, but it regularly fails to capture log events that are written during the rotation window. How should a solutions architect update the CloudWatch agent configuration to resolve this issue?
- Update the file_path setting in the CloudWatch agent configuration file to use a wildcard pattern, such as /var/log/app/current.log*, to ensure both the active and rotated log files are tracked.Answer
- BMaintain the static file_path of /var/log/app/current.log in the agent configuration, but increase the agent's polling frequency to capture events before rotation occurs.
- CModify the central S3 logging bucket policy to allow the EC2 instances to write log files directly to S3 using the S3 API during rotation.
- DConfigure the agent to use log_stream_name placeholders based on the system boot time to automatically reset the log file tracking index hourly.
Answer
Update the log file path configuration in the CloudWatch agent to use a wildcard pattern to track both the active and rotated files.
Using a wildcard pattern in the file path configuration allows the CloudWatch agent to monitor both the active log file and any rotated files matching the pattern. The agent tracks the state of each file based on its file system fingerprint (inode) and file offset, ensuring that log events written during the rotation window are successfully sent without duplicate delivery.
Step-by-Step Solution
Key Concept
Configuring the Unified CloudWatch Agent for Log Rotation using Wildcards