A SysOps Administrator is monitoring an application running on a fleet of Amazon EC2 insta… — AWS Certified SysOps Administrator - Associate

A SysOps Administrator is monitoring an application running on a fleet of Amazon EC2 instances. The application logs are streamed to an Amazon CloudWatch Logs log group named `/aws/app/production-backend` using the CloudWatch agent. The logs are structured in JSON format as follows:

{
"request_id": "req-9823f",
"path": "/checkout",
"latency_ms": 350,
"db_queries": 4
}

The administrator needs to monitor occurrences of high latency for the `/checkout` path. Specifically, they must trigger an AWS SNS notification if there are more than $5$ requests to `/checkout` where ` $latency_ms$ ` exceeds $500$ within any $1$ -minute window.

Which of the following configurations will meet these requirements?

A
Create a metric filter with the pattern `[path = "/checkout", latency_ms > 500]` and set the metric value to ` $.latency_ms`. Create an Amazon EventBridge rule to monitor the log group for this pattern, and trigger an AWS Systems Manager Automation document to count and aggregate these occurrences over a$ 1$-minute period.
Create a metric filter with the pattern `{ $.path = "/checkout" &&$ .latency_ms > 500 }`, and set the metric value to `1`. Configure a CloudWatch alarm based on this metric using the `Sum` statistic and a period of $1$ minute ( $60$ seconds).Answer
C
Enable Detailed Monitoring on the EC2 instances to allow CloudWatch to process log-derived metrics at $1$ -minute intervals. Then, create a metric filter with the pattern `{ $.path = "/checkout" &&$ .latency_ms > 500 }` and a metric value of `1` to feed the alarm.
D
Create a metric filter with the pattern `{ $.path = "/checkout" &&$ .latency_ms > 500 }` and set the metric value to `1`. In the CloudWatch log group properties, change the log retention period to $1$ day to ensure that metric data points are processed and aggregated every $24$ hours to prevent older logs from affecting the alarm evaluation.

Answer

Create a metric filter with the pattern `{

.path = "/checkout" &&

.latency_ms > 500 }`, and set the metric value to `1`. Configure a CloudWatch alarm based on this metric using the `Sum` statistic and a period of

1

minute (

60

seconds).

The correct answer uses the proper JSON filter pattern syntax `{

.path = "/checkout" &&

.latency_ms > 500 }`. By setting the metric value to `1`, each matching log entry acts as a single count. Applying the `Sum` statistic over

1

minute (

60

seconds) with a threshold of

> 5

matches the business requirements. Additionally, because CloudWatch Logs metric filters process logs on ingestion and publish data points at

1

-minute intervals automatically, changing EC2 instance monitoring configurations is unnecessary.

Step-by-Step Solution

Select the correct JSON filter pattern syntax.

.path = "/checkout" &&

.latency_ms > 500 }`

Since the logs are in JSON format, JSON path matching syntax must be used instead of space-delimited syntax.

Define the metric value to represent occurrences rather than values.

Metric Value = `1`

Setting the metric value to `1` ensures that each matching log entry increments the custom metric by 1, which represents an occurrence.

Configure the CloudWatch alarm threshold and statistic.

`Sum` statistic over

1

minute (

60

seconds) with threshold

> 5

To detect if there are more than

5

occurrences within any 1-minute window, the `Sum` statistic must be aggregated over a 1-minute period.

Evaluate the need for EC2 Detailed Monitoring.

No configuration change needed on EC2 instances.

CloudWatch Logs metric filters process logs in real-time as they are sent to CloudWatch Logs, and publish metrics at

1

-minute resolution by default.

Key Concept

CloudWatch Logs Metric Filters process log streams in real-time to generate metrics at 1-minute resolution, using JSON path expressions to match and extract fields from JSON logs.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic