Examkin

Soru

Zorluk: OrtaImproving Operational Excellence via Monitoring and Logging

An energy grid management company runs a telemetry ingestion application on a fleet of Amazon EC2 instances. The application writes log files to `/var/log/grid/telemetry.log`. A cron job rotates these logs hourly, renaming the active file to `telemetry.log.YYYY-MM-DD-HH` and creating a new empty `telemetry.log` file. The operations team configured the unified CloudWatch agent to monitor the active `/var/log/grid/telemetry.log` file, but they notice that log entries written immediately before and during the rotation process are frequently missed in Amazon CloudWatch Logs. Which configuration change will resolve this issue while maintaining operational excellence?

  1. Modify the CloudWatch agent configuration file by changing the `file_path` parameter to `/var/log/grid/telemetry.log*` to ensure the agent monitors both the active and rotated log files.Cevap
  2. B
    Modify the log rotation cron job to stop the CloudWatch agent service before rotating the file, and then start the agent service once the new log file is created.
  3. C
    Configure the CloudWatch agent configuration file to use `publish_multi_line_logs` pointing to the static path `/var/log/grid/telemetry.log` to flush the buffer before rotation.
  4. D
    Update the Amazon S3 bucket policy in the centralized logging account to allow the CloudWatch agent to directly upload the rotated files using an IAM role.

Cevap

Modify the CloudWatch agent configuration file by changing the file_path parameter to /var/log/grid/telemetry.log* to ensure the agent monitors both the active and rotated log files.
The correct option addresses the log rotation issue by using a wildcard character (`*`) in the `file_path` configuration. When the file is rotated and renamed to `telemetry.log.YYYY-MM-DD-HH`, the CloudWatch agent continues to read from the renamed file until it reaches the end of the file, while also starting to monitor the newly created `telemetry.log` file.

Adım Adım Çözüm

1
Analyze how the CloudWatch agent tracks log files.
The agent tailing a static path like `/var/log/grid/telemetry.log` will lose track of log events if the file is renamed during rotation while active writing continues or buffer flush is incomplete.
Understanding the interaction between the CloudWatch agent and file system rotation is critical to diagnosing log loss.
2
Select the correct pattern matching configuration.
Using a wildcard pattern such as `/var/log/grid/telemetry.log*` allows the agent to monitor both the active and rotated files concurrently, letting it process any remaining lines in the rotated file.
Wildcards allow the agent to track multiple files matching the pattern, ensuring continuity across rotation boundaries.

Anahtar Kavram

Configuring CloudWatch Agent for Log Rotation using Wildcards
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging