Examkin

Question

Difficulty: HardImproving Operational Excellence via Monitoring and Logging

An energy management company operates a critical power-grid monitoring application on a fleet of Amazon EC2 instances across multiple AWS accounts managed by AWS Organizations. The application logs are written to `/opt/app/logs/grid-metrics.log` and are rotated hourly by a custom script into the same directory as `/opt/app/logs/grid-metrics-YYYY-MM-DD-HH.log`. After 24 hours, the rotated logs are compressed to `/opt/app/logs/grid-metrics-YYYY-MM-DD-HH.log.gz`. The company needs to centralize these logs into an Amazon S3 bucket in a dedicated security account with minimal latency, ensuring no logs are lost during rotation, and compressed files are not duplicated or corrupted during ingestion. Which configuration strategy achieves this with the highest operational efficiency and least administrative overhead?

  1. Install the CloudWatch agent on the EC2 instances, and configure the file path `/opt/app/logs/grid-metrics*.log` to collect active and uncompressed rotated logs. In the central security account, create an Amazon Kinesis Data Firehose delivery stream pointing to the destination Amazon S3 bucket, and establish a CloudWatch Logs destination with an access policy that allows the source accounts to write to it. In the source accounts, configure CloudWatch Logs subscription filters to forward the collected log events to the central destination.Answer
  2. B
    Install the CloudWatch agent on the EC2 instances, and configure the file path `/opt/app/logs/grid-metrics.log`. Set up an hourly cron job on each EC2 instance that uses the AWS CLI to upload any rotated files matching the pattern `/opt/app/logs/grid-metrics-*.log` to the centralized Amazon S3 bucket. Restrict the S3 bucket policy in the security account to trust only the IAM roles of the source EC2 instances.
  3. C
    Install the CloudWatch agent on the EC2 instances, and configure the file path `/opt/app/logs/grid-metrics*` to ensure all generated log files are captured. Configure the S3 bucket policy in the central security account to permit the root principal of the source accounts to write directly to the bucket. In the source accounts, configure the CloudWatch agent to write log files directly to the central S3 bucket using cross-account IAM roles.
  4. D
    Install the CloudWatch agent on the EC2 instances, and configure the file path `/opt/app/logs/grid-metrics-*.log`. Configure an AWS Lambda function in the central security account that is triggered hourly to invoke AWS Systems Manager Run Command across the source EC2 instances to retrieve the active `/opt/app/logs/grid-metrics.log` content, writing the consolidated output directly to the destination Amazon S3 bucket.

Answer

The correct strategy is to install the CloudWatch agent using the file path pattern `/opt/app/logs/grid-metrics*.log` to match active and rotated uncompressed logs while ignoring compressed files, and streaming them to a central security account's Kinesis Data Firehose via CloudWatch Logs subscription filters.
The configuration utilizing the file path pattern `/opt/app/logs/grid-metrics*.log` correctly matches both the active log and the uncompressed hourly rotated logs, while ignoring the compressed archives ending in `.gz`. Forwarding these logs through CloudWatch subscription filters to a central Kinesis Data Firehose delivery stream represents a highly scalable, real-time, managed architecture that complies with operational excellence principles. It avoids the need for custom scripts, cron jobs, and direct S3 bucket permissions on the EC2 instances.

Step-by-Step Solution

1
Select the log path pattern for the CloudWatch agent that matches uncompressed active and rotated logs.
Using the file path `/opt/app/logs/grid-metrics*.log` successfully targets both the active `grid-metrics.log` and the uncompressed rotated `grid-metrics-YYYY-MM-DD-HH.log` files, but excludes compressed `.gz` archives.
This prevents duplicate ingestion and corruption that would occur if the agent attempted to read compressed binary data as text.
2
Design the centralized destination in the security account.
An Amazon Kinesis Data Firehose delivery stream backed by the S3 bucket is established, and a CloudWatch Logs destination points to this Firehose stream.
Kinesis Data Firehose provides real-time streaming and buffered writes to S3, while the CloudWatch Logs destination acts as an ingestion endpoint.
3
Set up cross-account access and log subscription filters.
The CloudWatch Logs destination policy is configured to trust the source Organization accounts, and subscription filters in the source accounts are pointed to the destination.
This allows native, secure, and low-latency forwarding of log events directly to the centralized storage without exposing direct S3 access to EC2 instances.

Key Concept

Log rotation handling in CloudWatch agent configuration combined with cross-account subscription filters for centralized log aggregation.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging