Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

An enterprise runs a batch processing application on hybrid on-premises servers and Amazon EC2 instances. The application writes execution logs to `/var/log/app/batch.log`. To comply with compliance and auditing policies, these logs are rotated hourly and renamed using the format `/var/log/app/batch.log.YYYY-MM-DD-HH`. A Solutions Architect is deploying the unified CloudWatch agent to collect these logs and publish them to Amazon CloudWatch Logs. Which configuration strategy for the CloudWatch agent should the Solutions Architect implement to ensure that logs are continuously collected without gaps during and after the hourly rotation process?

  1. A
    Specify the static file path `/var/log/app/batch.log` in the `file_path` parameter of the agent configuration file and rely on the operating system file descriptor tracking to capture rotated log data.
  2. B
    Configure the agent to write directly to an Amazon S3 bucket in a centralized security account, using an S3 bucket policy that permits public write access to simplify cross-account authentication.
  3. Use a wildcard pattern `/var/log/app/batch.log*` in the `file_path` parameter of the agent configuration file to ensure the agent monitors both the active and rotated files during the transition.Answer
  4. D
    Enable log encryption using the AWS-managed KMS key for CloudWatch Logs (`aws/logs`) and configure the monitoring account's cross-account access by updating the policy of this AWS-managed key.

Answer

Use a wildcard pattern `/var/log/app/batch.log*` in the `file_path` parameter of the agent configuration file to ensure the agent monitors both the active and rotated files during the transition.
Specifying a wildcard pattern `/var/log/app/batch.log*` in the `file_path` parameter of the CloudWatch agent configuration allows the agent to monitor both the active log file and any rotated files. This ensures that any log entries that remain in the buffer or are written during the rotation window are successfully captured and uploaded.

Step-by-Step Solution

1
Analyze the log rotation mechanism of the application.
The application writes to a static log file, which is renamed to include a timestamp hourly, and a new empty log file is created.
Understanding how the source application handles log files is critical to determining how the collection agent must be configured.
2
Select the correct path syntax for the CloudWatch agent config.
Using a wildcard pattern `/var/log/app/batch.log*` enables the agent to continuously monitor the active file and catch any remaining or late-written lines in the rotated files.
A static path configuration fails to track the renamed file during rotation, potentially leading to data loss.
3
Address encryption and security permissions appropriately.
Avoid modifying AWS-managed KMS keys or opening public write access to S3, using customer-managed KMS keys and secure IAM roles instead.
Ensures the solution maintains operational excellence and security compliance without using invalid AWS actions.

Key Concept

CloudWatch Agent Log Tracking and Wildcard Configuration
Estimated Time:2m 0s
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging