Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

An application runs on EC2 instances and streams its access logs to an Amazon CloudWatch Logs group. The logs are formatted as space-delimited text lines representing the timestamp, client IP address, request path, HTTP status code, and latency in milliseconds. Below is an example log event:

`1719264000 192.0.2.10 /orders/create 504 3500`

A SysOps administrator needs to set up an alarm to alert the operations team when requests to `/orders/create` experience a gateway timeout (504504) and take more than 3000 ms3000\text{ ms} to complete. Which two actions should the administrator perform to configure this monitoring and alarm solution? (Select two.)

  1. Create a CloudWatch metric filter on the log group using the filter pattern `[timestamp, client_ip, request_path = "/orders/create", status_code = 504, latency > 3000]`, and set the metric value to 11.Answer
  2. Create a CloudWatch alarm associated with the custom metric generated by the metric filter, defining the threshold to trigger when the count exceeds the acceptable limit.Answer
  3. C
    Enable Detailed Monitoring on the EC2 instances hosting the application to ensure that the log-derived custom metric is evaluated at 1-minute1\text{-minute} intervals.
  4. D
    Configure the log group retention period to 11 day to ensure that log events are processed by the custom metric filter at a faster ingestion rate.
  5. E
    Create an Amazon EventBridge rule that directly parses the space-delimited log patterns from the log stream and triggers an AWS Systems Manager Automation runbook to increment the custom metric.

Answer

To implement the monitoring and alarm solution, the administrator must create a CloudWatch metric filter using the space-delimited positional pattern `[timestamp, client_ip, request_path = "/orders/create", status_code = 504, latency > 3000]` with a metric value of 11, and then create a CloudWatch alarm that monitors this custom metric and triggers when the threshold is exceeded.
The correct approach requires first extracting the relevant metric from the space-delimited log events using a CloudWatch Logs metric filter with the correct positional syntax and a metric value of 11. After the custom metric is published, a CloudWatch alarm must be configured to monitor the custom metric and trigger notifications when the threshold is exceeded.

Step-by-Step Solution

1
Define the CloudWatch Logs metric filter pattern for space-delimited logs.
A pattern `[timestamp, client_ip, request_path = "/orders/create", status_code = 504, latency > 3000]` is constructed matching the fields in the log events.
The space-delimited syntax uses square brackets to list fields sequentially and filter them based on exact values or numeric comparisons.
2
Assign a metric value and publish the metric to a custom namespace.
The metric filter is configured with a metric value of 11, which increments the metric for each matching log line.
Setting the metric value to 11 counts the occurrences of the matching pattern in the log stream.
3
Create a CloudWatch alarm based on the custom metric.
A CloudWatch alarm is created to evaluate the custom metric over a specified period and trigger when it exceeds 00.
An alarm is needed to alert the operations team when the count of failed/slow requests exceeds the acceptable threshold.

Key Concept

Creating metric filters on space-delimited CloudWatch Logs and configuring alarms based on the resulting custom metrics.
Estimated Time:2m 0s
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic