Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

An enterprise application runs on Amazon EC2 instances within an Auto Scaling group. The application writes logs to `/var/log/app/output.log`. Every hour, a cron job rotates the log file by renaming the active file to `/var/log/app/output.log.YYYY-MM-DD-HH` and creating a new empty `/var/log/app/output.log` file. The CloudWatch agent is configured on the instances to stream `/var/log/app/output.log` to a CloudWatch Logs group. However, after the first hourly log rotation occurs, the operations team notices that new log entries are no longer delivered to CloudWatch until the CloudWatch agent is restarted. Which configuration change in the CloudWatch agent configuration file is required to resolve this issue and ensure continuous log delivery?

  1. Modify the `file_path` parameter in the CloudWatch agent configuration file to use a wildcard pattern, such as `/var/log/app/output.log*`, so that the agent monitors the directory and identifies both the renamed historical files and the newly created active file.Answer
  2. B
    Retain the static `/var/log/app/output.log` file path in the agent configuration and append a `rotation_interval` key set to `1h` to instruct the agent to release the file handle and reopen the file hourly.
  3. C
    Change the `file_path` parameter to point to a central Amazon S3 bucket path, such as `s3://company-logs-bucket/app/output.log`, and ensure the S3 bucket policy grants the EC2 instance profile's role the `s3:PutObject` permission.
  4. D
    Configure the `file_path` to point to the system log manager path at `/var/log/messages` and enable the `syslog` protocol module in the agent configuration, relying on the operating system to relay the rotated logs.

Answer

Modify the `file_path` parameter in the CloudWatch agent configuration file to use a wildcard pattern, such as `/var/log/app/output.log*`, so that the agent monitors the directory and identifies both the renamed historical files and the newly created active file.
The correct answer is to modify the `file_path` parameter to use a wildcard pattern. When the CloudWatch agent monitors a static file path, it maintains an open file descriptor. When log rotation renames the file, the agent continues to read from the renamed file (since the inode doesn't change) until it reaches the end of the file, but it will not automatically open the new file created with the original name. By specifying a wildcard pattern like `/var/log/app/output.log*`, the agent monitors the directory for files matching the pattern, enabling it to detect and stream from the new active file as soon as it is created.

Step-by-Step Solution

1
Analyze the log rotation mechanism and how the CloudWatch agent tracks files.
The application renames the active `/var/log/app/output.log` file and creates a new one. Since the agent was tracking the specific file path, it retains the file descriptor for the renamed file and fails to open the new file containing the active log stream.
To understand why log delivery stops after rotation.
2
Identify the configuration parameter in the CloudWatch agent config that controls file tracking.
The `file_path` parameter specifies the path of the files to collect logs from. It supports wildcard patterns.
To determine where and how the configuration needs to be modified.
3
Formulate a wildcard pattern that covers both the active and rotated files.
Using a pattern like `/var/log/app/output.log*` ensures that when a new `/var/log/app/output.log` file is created, it matches the pattern and the agent starts tracking it automatically.
To restore continuous log streaming without agent restarts.

Key Concept

CloudWatch Agent Wildcard File Path Configuration
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging