Examkin

Question

Difficulty: EasyCloudWatch Logs and Metric Filters

An administrator wants to count database connection timeout errors in an application's logs using Amazon CloudWatch. The administrator sets up a metric filter on the log group to scan for the term 'Timeout' and configures a metric transformation to publish a value of 11 for each occurrence.

Which additional action is necessary to trigger a notification when the frequency of timeout errors exceeds a specific threshold?

  1. A
    Configure an Amazon EventBridge rule that monitors the status of the metric filter directly to send the notification.
  2. B
    Enable detailed monitoring on the application log group to aggregate the log metrics at a 11-minute interval.
  3. Create a CloudWatch alarm based on the new custom metric, and configure an Amazon SNS action to send the notification.Answer
  4. D
    Set the retention policy of the log group to a custom threshold to force metric delivery to SNS.

Answer

Create a CloudWatch alarm based on the new custom metric, and configure an Amazon SNS action to send the notification.
The correct answer is to create a CloudWatch alarm based on the new custom metric, and configure an Amazon SNS action. Metric filters parse logs and output metrics, but do not possess alerting capabilities. A CloudWatch alarm must monitor the metric and trigger an SNS topic to notify administrators when thresholds are exceeded.

Step-by-Step Solution

1
Verify that the metric filter is successfully scanning log events and outputting data to the custom metric.
The metric contains data points representing log occurrences.
Before an alarm can evaluate a metric, the metric must exist and receive data.
2
Create a CloudWatch alarm on the custom metric, setting the threshold and evaluation period.
An alarm is created to evaluate the metric over the specified time window.
An alarm is the only native CloudWatch mechanism that can evaluate thresholds and trigger state changes (OK, ALARM, INSUFFICIENT_DATA).
3
Configure an Amazon Simple Notification Service (SNS) action on the alarm state change to ALARM.
A notification is sent to the target topic subscribers when the metric exceeds the threshold.
Alarms must be associated with actions, such as Amazon SNS, to deliver external notifications to administrators.

Key Concept

CloudWatch metric filters define how log data is converted into metrics, while CloudWatch alarms monitor those metrics and initiate notifications or scaling actions.
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic