Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

A logistics platform runs a fleet of delivery tracking services on Amazon EC2 instances. The tracking application outputs internal transaction metrics to a file located at `/var/log/tracking/session.log`. During peak hours, a cron job on the server executes a log rotation script that compresses and renames the active log file to `/var/log/tracking/archive-[timestamp].log.gz` and creates a new empty `/var/log/tracking/session.log`. The operations team uses the Unified CloudWatch Agent to monitor these metrics, but they notice that metrics are missing for hours at a time, specifically starting immediately after each log rotation event. Which configuration change will ensure that the CloudWatch Agent continuously collects the log files without interruption?

  1. A
    Modify the CloudWatch Agent configuration by setting the `file_path` parameter to `/var/log/tracking/session.log` and enabling the `publish_multi_line_logs` option to process the compressed archives.
  2. B
    Configure the S3 bucket policy where the logs are archived to allow the EC2 IAM role to perform `s3:PutObject` on `/var/log/tracking/` path prefixes.
  3. Update the agent configuration file to use the wildcard path `/var/log/tracking/session*` in the `file_path` parameter, ensuring that the agent dynamically tracks both the active and renamed log files.Answer
  4. D
    Change the `file_path` parameter in the agent configuration to `/var/log/tracking/session.log` and configure the agent to restart automatically via a systemd trigger whenever a log rotation event occurs.

Answer

Updating the CloudWatch Agent configuration file to use a wildcard path such as `/var/log/tracking/session*` in the `file_path` parameter is the correct solution.
Updating the agent configuration file to use a wildcard path allows the agent to track both the active and renamed log files dynamically, preventing any interruption in log collection.

Step-by-Step Solution

1
Identify how the log rotation script behaves on the EC2 instances.
The script renames the active file `/var/log/tracking/session.log` and creates a new empty file, which changes the file identity (inode/descriptor) tracked by the agent.
Understanding the rotation mechanism helps determine why a static file path configuration fails to capture logs post-rotation.
2
Evaluate the CloudWatch Agent configuration options for file paths.
A static file path fails to track renamed files, whereas a wildcard pattern like `/var/log/tracking/session*` allows the agent to dynamically discover and monitor files matching the pattern.
Selecting the correct wildcard path resolves the tracking gap during and after log rotation.

Key Concept

Configuring CloudWatch Agent to handle log rotation using wildcards.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging