Examkin

Question

Difficulty: Very hardCloudWatch Logs and Metric Filters

A SysOps Administrator is monitoring an e-commerce application log group named /aws/app/ecommerce in Amazon CloudWatch Logs. The application publishes database timeout event logs in the following JSON format:

`{ "requestId": "req-123", "service": "InventoryService", "event": "DB_TIMEOUT", "details": { "duration_ms": 1500, "retryCount": 3 } }`

The administrator needs to monitor the average timeout duration, count the occurrences, and trigger an alert if the average duration exceeds 2000 ms over a 5-minute period.

Which combination of actions must the SysOps Administrator perform to meet these requirements? (Select TWO.)

  1. Create a metric filter on the /aws/app/ecommerce log group with the filter pattern { .event = "DB_TIMEOUT" }, and publish a custom metric where the metric value is set to .details.duration_ms.Answer
  2. Create a CloudWatch alarm based on the custom metric, using the Average statistic, a period of 5 minutes, a threshold greater than 2000, and an Amazon SNS topic as the action.Answer
  3. C
    Enable detailed monitoring on the EC2 instances hosting the application to ensure that the log group metric filter can publish metrics at 1-minute resolution instead of the default 5-minute resolution.
  4. D
    Modify the /aws/app/ecommerce log group retention setting to "Never Expire" to prevent metric filters from losing historical data when computing the 5-minute average.
  5. E
    Configure an AWS Config rule to evaluate the custom metric value, and associate the rule with a Systems Manager Automation document to publish a notification message to the SNS topic.

Answer

To configure the monitoring and alerting system, create a metric filter with the filter pattern that matches the JSON path for the timeout event and extracts the duration value. Then, configure a CloudWatch alarm that tracks the Average statistic of this custom metric over a 5-minute period and notifies an SNS topic if it exceeds 2000.
To process the JSON log events, a CloudWatch metric filter needs to select the relevant JSON key and extract the corresponding value. The pattern `{ .event = "DB_TIMEOUT" }` correctly targets the database timeout logs, and the value is mapped to `.details.duration_ms` to populate the custom metric. To alert on this data, a CloudWatch alarm must evaluate the metric using the Average statistic, a period of 5 minutes, and a threshold of 2000, triggering an SNS notification upon threshold breach.

Step-by-Step Solution

1
Analyze the JSON log structure and create a metric filter to target the database timeout events.
A metric filter is defined with the pattern `{ $.event = "DB_TIMEOUT" }`.
This filters the log streams to target only database timeout entries.
2
Configure the metric value extraction for the filter.
The metric value is set to `$.details.duration_ms`.
This extracts the numerical latency value of each timeout event so that statistical operations can be performed on the metric.
3
Create a CloudWatch alarm on the newly created custom metric.
The alarm is configured with the Average statistic, a period of 300 seconds (5 minutes), and a threshold of 2000.
This monitors the average latency over the 5-minute window as specified in the requirements.
4
Define the alarm action to trigger notification routing.
The alarm state triggers a notification to an Amazon SNS topic when transitioning to the ALARM state.
This ensures support teams receive an email or message whenever the average database timeout exceeds the threshold.

Key Concept

Extracting custom numerical metric data from JSON logs using CloudWatch metric filters and configuring standard CloudWatch alarms to monitor statistical averages over a defined period.
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic