Examkin

Question

Difficulty: Very hardMonitoring and Logging

An enterprise organization is deploying a fleet of Compute Engine instances running custom Linux images. The SRE team requires collection of system memory metrics, disk space utilization, and custom application log files stored at `/var/log/app/*.log`. Following Google Cloud recommended practices and the principle of least privilege, which TWO operational actions must be performed to enable telemetry ingestion and authorization?

  1. Install the unified Google Cloud Ops Agent on the Compute Engine instances and define a custom log receiver pipeline pointing to `/var/log/app/*.log` inside the agent configuration file (`config.yaml`).Answer
  2. Attach a dedicated service account to the Compute Engine instances that has been granted the `roles/logging.logWriter` and `roles/monitoring.metricWriter` IAM roles.Answer
  3. C
    Install the legacy Stackdriver Monitoring Agent alongside the legacy Stackdriver Logging Agent and grant the service account the `roles/editor` primitive role.
  4. D
    Enable the Cloud Logging and Monitoring APIs at the Google Cloud Organization resource level and download JSON service account keys to embed inside each VM instance.

Answer

Telemetry collection for Compute Engine system metrics (including memory and disk) and custom log files requires installing the unified Google Cloud Ops Agent configured with custom log receiver pipelines, along with attaching a service account to the VMs possessing the predefined `roles/logging.logWriter` and `roles/monitoring.metricWriter` IAM roles.
To collect OS-level telemetry like RAM utilization and custom file logs from Compute Engine, the Google Cloud Ops Agent must be installed and configured with a custom pipeline in `config.yaml`. Furthermore, for the VM instances to securely send telemetry to Cloud Operations under least privilege principles, the attached service account requires the predefined roles `roles/logging.logWriter` and `roles/monitoring.metricWriter`.

Step-by-Step Solution

1
Determine telemetry collection agent requirement
Identify that default Compute Engine metrics do not capture OS-internal memory utilization or custom file logs, requiring the installation of the unified Google Cloud Ops Agent.
The Ops Agent is Google's recommended unified agent for Compute Engine VMs that handles both system metrics and log collection.
2
Configure custom application log ingestion
Edit `/etc/google-cloud-ops-agent/config.yaml` on the VMs to add a custom logging receiver for `/var/log/app/*.log` files.
The Ops Agent uses a YAML configuration file to define custom files and formats for log ingestion.
3
Determine IAM permissions according to least privilege
Select the minimal predefined IAM roles `roles/logging.logWriter` and `roles/monitoring.metricWriter` for the VM's service account.
These specific predefined roles grant write permissions for Cloud Logging and Monitoring telemetry without exposing excess permissions.

Key Concept

Google Cloud Ops Agent Configuration & Least Privilege IAM Authorization
Estimated Time:3m 0s
Rate this question

Topics

Monitoring and Logging

More questions from this topic