A SysOps Administrator is configuring a monitoring solution for a fleet of web servers. Th… — AWS Certified SysOps Administrator - Associate

A SysOps Administrator is configuring a monitoring solution for a fleet of web servers. The web servers write access logs to an Amazon CloudWatch Logs group in the Apache Common Log Format (CLF). The administrator needs to monitor for server-side errors and identify instances where response sizes exceed $10\text{ KB}$ ( $10,000\text{ bytes}$ ). Specifically, if there are more than $15$ occurrences of HTTP status codes in the $5xx$ range combined with a response size greater than $10,000\text{ bytes}$ within any $5\text{-minute}$ window, the administrator must receive an email notification. Additionally, to manage costs, the log group's retention period must be automatically adjusted to $30$ days if a peak event occurs, as it is currently set to never expire. Which TWO actions should the SysOps Administrator take to meet these requirements?

Create a metric filter on the log group using the pattern `[ip, id, user, timestamp, request, status_code = 5*, size > 10000]`. Create a CloudWatch alarm based on this metric with a threshold of $15$ within a $5\text{-minute}$ period, and configure an Amazon SNS action to send an email notification.Answer
Create an Amazon EventBridge rule that triggers when the CloudWatch alarm transitions to the `ALARM` state, and configure the rule to target an AWS Systems Manager Automation document to update the log group's retention period to $30$ days.Answer
C
Add a remediation action directly to the CloudWatch alarm configuration to modify the log group's retention period to $30$ days using the CloudWatch Logs service action.
D
Enable detailed monitoring on the CloudWatch Logs group to ensure log events are processed at $1\text{-minute}$ intervals, then configure the CloudWatch alarm with a $1\text{-minute}$ period to evaluate the threshold.
E
Configure an AWS Config rule to monitor the CloudWatch alarm status, and define an AWS Config remediation target that directly invokes an AWS Lambda function to change the log group retention when the alarm status becomes non-compliant.

Answer

Create a metric filter with the pattern tracking status code 5* and size > 10000, setting up a CloudWatch alarm with SNS notifications, and create an EventBridge rule triggered by the alarm to run an SSM Automation document updating the log group retention to 30 days.

The correct options involve setting up a metric filter mapping the fields of the Apache CLF format to target status code 5* and response size > 10000. An alarm is configured on the resulting metric to trigger an SNS notification. To dynamically update the log retention, an EventBridge rule must be created to detect when the alarm enters the `ALARM` state, triggering an SSM Automation document that changes the log group retention configuration.

Step-by-Step Solution

Parse the incoming log format and create a CloudWatch metric filter.

A metric filter with the pattern `[ip, id, user, timestamp, request, status_code = 5*, size > 10000]` is created, mapping to a custom metric.

Apache Common Log Format (CLF) maps variables positionally: client IP, client RFC 1413 identity, userid, timestamp, request string, status code, and size. Filtering status code with prefix 5* captures

5xx

errors, and size captures bytes.

Create a CloudWatch alarm on the generated custom metric.

An alarm is configured with a threshold of

15

over a evaluation period of

5\text{-minute}

and linked to an SNS topic for email alerts.

This evaluates the metric frequency within the required time window and notifies the administrator upon threshold breach.

Configure the automated remediation flow for log retention.

An EventBridge rule matches the alarm state transition to `ALARM` and invokes an SSM Automation document.

Alarms cannot execute administrative APIs like modifying log retention directly, so EventBridge must route the event to SSM Automation.

Key Concept

CloudWatch Logs Metric Filters and Event-Driven Remediation

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic