Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

An enterprise financial services company runs a payment settlement application on a fleet of Amazon EC2 instances. The application writes transaction events to `/var/log/settlement/transactions.log`. An hourly cron job rotates the log file by renaming the current file to `/var/log/settlement/transactions.log.YYYY-MM-DD-HH` and creating a new empty `/var/log/settlement/transactions.log` file. A solutions architect is configuring the unified Amazon CloudWatch agent on these instances to publish the log data to CloudWatch Logs. Which configuration approach should the solutions architect use to ensure all log entries are collected reliably across rotations without duplicating or missing log events?

  1. Configure the CloudWatch agent log file path to `/var/log/settlement/transactions.log`. The agent will automatically track the file descriptor or inode to process the rotated file to completion, and then open the newly created active log file.Answer
  2. B
    Configure the CloudWatch agent log file path using a wildcard pattern as `/var/log/settlement/transactions.log*`. This ensures that both the active log file and all rotated files are continuously monitored.
  3. C
    Configure the CloudWatch agent log file path to `/var/log/settlement/transactions.log` and schedule a cron job that restarts the CloudWatch agent service hourly immediately after the log rotation script finishes.
  4. D
    Configure the application to bypass local logging and write directly to an S3 bucket in a central logging account, using a bucket policy that grants `s3:PutObject` access to the `log-delivery.amazonaws.com` service principal without specifying individual AWS account IDs.

Answer

Configure the CloudWatch agent log file path to the active log file `/var/log/settlement/transactions.log`. The agent will automatically track the file descriptor or inode to process the rotated file to completion, and then open the newly created active log file.
The correct configuration is to point the CloudWatch agent to the active log file path. The CloudWatch agent keeps an open file handle (tracking the inode) of the file it is reading. When the log rotation system renames the file, the agent continues reading from the renamed file via its open file handle until it reaches the end of the file (EOF). Concurrently, the agent detects that a new file has been created at the configured path and opens it to begin reading new log entries. This built-in behavior ensures seamless log collection without duplication or missing events.

Step-by-Step Solution

1
Analyze the log rotation mechanism and the capabilities of the unified Amazon CloudWatch agent.
The application writes to a static path, which is rotated to a timestamped path hourly. The CloudWatch agent tracks monitored files using file handles/inodes.
Understanding how the agent tracks file state determines whether wildcards or static paths should be used to avoid missing or duplicating log entries.
2
Evaluate the static path configuration.
By specifying the active log path `/var/log/settlement/transactions.log`, the agent monitors the active file. When rotated (renamed), the agent maintains the file handle to finish reading the renamed file, then opens the new file with the original name.
This is the native, recommended behavior of the CloudWatch agent for rotated log files.
3
Evaluate the wildcard path configuration.
Using `/var/log/settlement/transactions.log*` matches both the active file and all rotated files, causing the agent to discover the rotated files as new files and re-ingest them.
This results in log duplication and unnecessary data ingestion costs, making it incorrect.

Key Concept

The unified Amazon CloudWatch agent tracks active log files by their file descriptors/inodes, allowing it to handle standard log rotation automatically without needing wildcards or service restarts.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging