Examkin

Soru

Zorluk: OrtaMonitoring and Analyzing Logs with Amazon CloudWatch

A developer has deployed a Java application on an Amazon EC2 instance. The application logs details, including multi-line stack traces, to a local file at `/var/log/app/output.log`. The developer has configured the unified Amazon CloudWatch agent on the instance to stream these logs to a CloudWatch Logs log group. However, when viewing the logs in the CloudWatch console, each line of a single Java stack trace appears as a separate log event, making troubleshooting difficult. Which action should the developer take to group each multi-line stack trace into a single log event?

  1. A
    Modify the CloudWatch Logs log group settings in the AWS Management Console to enable multi-line log detection.
  2. Configure the `multi_line_start_pattern` parameter in the Amazon CloudWatch agent configuration file to define a regular expression matching the start of each logical log message.Cevap
  3. C
    Configure a CloudWatch metric filter with a regular expression that aggregates multiple incoming log streams based on a timeout value.
  4. D
    Attach an IAM policy to the EC2 instance role that grants the `logs:PutLogEvents` permission with a condition that enforces multi-line formatting.

Cevap

Configure the `multi_line_start_pattern` parameter in the Amazon CloudWatch agent configuration file to define a regular expression matching the start of each logical log message.
Configuring the `multi_line_start_pattern` parameter in the CloudWatch agent configuration file allows the agent to identify the start of a new log event using a regular expression (e.g., matching a timestamp). Any subsequent lines that do not match the pattern are treated as part of the current log event, ensuring that multi-line stack traces are correctly grouped and ingested as a single event.

Adım Adım Çözüm

1
Identify where the log grouping needs to occur.
Determine that log grouping must happen at ingestion time on the source instance (EC2) rather than inside CloudWatch Logs.
Once logs are transmitted as separate events, CloudWatch Logs does not provide a feature to merge them back into a single event.
2
Locate the Amazon CloudWatch agent configuration file on the EC2 instance.
Access the JSON configuration file, typically located at `/opt/aws/amazon-cloudwatch-agent/bin/config.json`.
The agent configuration controls how log files are read and streamed.
3
Add the `multi_line_start_pattern` setting to the log file configuration section.
Specify a regex pattern (e.g., matching the timestamp format of the log) that indicates the beginning of a new log entry.
The agent will group all lines that do not match the start pattern into the current log entry, maintaining the integrity of the stack trace.

Anahtar Kavram

Handling multi-line log events with the CloudWatch Agent configuration
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Monitoring and Analyzing Logs with Amazon CloudWatch

Bu konudan daha fazla soru