Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

A media company runs a critical content delivery application on a fleet of Amazon EC2 instances. The application writes log data to `/var/log/app/access.log`. To manage local disk space, a log rotation utility runs hourly, renaming the active file to `/var/log/app/access-YYYYMMDD-HH.log` and creating a new empty `/var/log/app/access.log` file. The company uses the Unified CloudWatch Agent to stream these logs to Amazon CloudWatch Logs. During testing, log ingestion into CloudWatch Logs stops immediately after the first hourly log rotation completes. Which action should the Solutions Architect take to resolve this issue and ensure continuous log ingestion?

  1. Modify the Unified CloudWatch Agent configuration file by changing the `file_path` parameter under the logs section to `/var/log/app/access*.log`.Answer
  2. B
    Retain the static `/var/log/app/access.log` path in the agent configuration file, and configure a cron job to restart the Unified CloudWatch Agent service immediately after each hourly log rotation.
  3. C
    Modify the S3 bucket policy in the centralized logging account to allow the EC2 instances' IAM role to perform `s3:PutObject` operations using a wildcard for the log file names.
  4. D
    Specify the static `/var/log/app/access.log` path in the agent configuration file, and enable the `auto_reload` parameter in the agent's global settings block.

Answer

Modify the Unified CloudWatch Agent configuration file by changing the `file_path` parameter under the logs section to `/var/log/app/access*.log`.
Modifying the file path to use a wildcard pattern allows the Unified CloudWatch Agent to monitor the directory for new log files matching the pattern. When log rotation occurs, the agent will dynamically discover the newly created active log file and continue ingestion without interruption.

Step-by-Step Solution

1
Analyze how the log rotation utility modifies files on the EC2 instances.
The active log file `/var/log/app/access.log` is renamed to `/var/log/app/access-YYYYMMDD-HH.log` and a new `/var/log/app/access.log` is created, altering the file descriptor tracked by the agent.
Understanding the rotation mechanism helps identify why a static file path configuration fails after rotation occurs.
2
Evaluate the Unified CloudWatch Agent's file tracking capabilities.
The agent requires a wildcard pattern to monitor log directories and identify newly created files or rotated files matching the pattern.
Configuring a wildcard pattern like `/var/log/app/access*.log` ensures both active and rotated logs are matched and tracked continuously.
3
Eliminate options that introduce administrative overhead or target incorrect resources.
Restarts via cron jobs and S3 bucket policy changes do not fix the agent's path matching logic and add operational complexity.
This guarantees a simple, robust, and native cloud architecture configuration.

Key Concept

Configuring the Unified CloudWatch Agent to handle log rotation using wildcard path patterns.
Estimated Time:1m 30s
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging