Examkin

Question

Difficulty: Very hardImproving Operational Excellence via Monitoring and Logging

An enterprise maintains a legacy critical application hosted on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in AWS Organizations. The application rotates its internal logs hourly, renaming the active log file `/var/log/app/transaction.log` to `/var/log/app/transaction.log.YYYY-MM-DD-HH` and compressing it. System operators need to aggregate these rotated logs into a centralized Amazon S3 bucket located in a dedicated Security account. The collection must occur in near real-time, preserve the rotated files, and tolerate instance termination. The current setup uses a CloudWatch agent configuration that fails to send rotated logs consistently, and logs are occasionally lost. Which of the following solutions should a Solutions Architect implement to resolve this logging gap and ensure operational excellence?

  1. Update the CloudWatch agent configuration on the EC2 instances to specify `/var/log/app/transaction.log*` in the file path and enable log auto-rotation tracking. Configure the CloudWatch log group to stream to an Amazon Kinesis Data Firehose in the Security account via a cross-account CloudWatch subscription filter, which then delivers the logs to the centralized S3 bucket.Answer
  2. B
    Modify the CloudWatch agent configuration on the EC2 instances to track only `/var/log/app/transaction.log` and schedule a hourly cron job on the instances to copy the compressed `/var/log/app/transaction.log.*` files directly to the centralized S3 bucket using the AWS CLI.
  3. C
    Configure the CloudWatch agent to monitor `/var/log/app/transaction.log` with a custom script that restarts the agent hourly after log rotation occurs. Configure a cross-account S3 bucket policy in the Security account that permits local IAM roles from the member accounts to call s3:PutObject directly.
  4. D
    Deploy a systems manager agent configuration to copy `/var/log/app/transaction.log` to Amazon CloudWatch Logs. In the Security account, configure an Amazon EventBridge rule that triggers a Lambda function to query CloudWatch Logs from the member accounts and export them to S3 hourly.

Answer

Configure the CloudWatch agent to track rotated files with a wildcard pattern and stream logs cross-account using CloudWatch subscription filters to Amazon Kinesis Data Firehose, which writes to the centralized S3 bucket.
The correct solution uses the CloudWatch agent configured with a wildcard pattern to ensure log rotation does not interrupt log ingestion. It then leverages CloudWatch subscription filters to stream logs to a centralized Kinesis Data Firehose in the Security account in near real-time, guaranteeing durability and decoupling the source instances from direct S3 access.

Step-by-Step Solution

1
Configure the CloudWatch agent with wildcards.
The agent tracks the active log file and rotated files matching the pattern `/var/log/app/transaction.log*`.
This ensures that when the log is rotated and renamed, the agent identifies the rotation and continues forwarding new logs without loss.
2
Set up CloudWatch Subscription Filters.
Log groups in individual accounts stream log data to a destination in the centralized Security account.
This provides real-time, cross-account log routing directly from CloudWatch Logs to a centralized processing stream.
3
Deploy Amazon Kinesis Data Firehose.
Log data is batched, compressed, and delivered to the central S3 bucket in the Security account.
This ensures delivery reliability, manages ingestion rate limits, and secures logs in a read-only centralized location.

Key Concept

Cross-account log aggregation with rotation resilience
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging