Examkin

Soru

Zorluk: KolayImproving Operational Excellence via Monitoring and Logging

An application runs on Amazon EC2 instances and writes log events to a local file at /var/log/app/current.log. The logs are rotated hourly and renamed with a timestamp suffix, after which a new current.log file is created. The CloudWatch agent is configured to collect these logs, but it regularly fails to capture log events that are written during the rotation window. How should a solutions architect update the CloudWatch agent configuration to resolve this issue?

  1. Update the file_path setting in the CloudWatch agent configuration file to use a wildcard pattern, such as /var/log/app/current.log*, to ensure both the active and rotated log files are tracked.Cevap
  2. B
    Maintain the static file_path of /var/log/app/current.log in the agent configuration, but increase the agent's polling frequency to capture events before rotation occurs.
  3. C
    Modify the central S3 logging bucket policy to allow the EC2 instances to write log files directly to S3 using the S3 API during rotation.
  4. D
    Configure the agent to use log_stream_name placeholders based on the system boot time to automatically reset the log file tracking index hourly.

Cevap

Update the log file path configuration in the CloudWatch agent to use a wildcard pattern to track both the active and rotated files.
Using a wildcard pattern in the file path configuration allows the CloudWatch agent to monitor both the active log file and any rotated files matching the pattern. The agent tracks the state of each file based on its file system fingerprint (inode) and file offset, ensuring that log events written during the rotation window are successfully sent without duplicate delivery.

Adım Adım Çözüm

1
Analyze how the log rotation affects file tracking in the CloudWatch agent.
Renaming the file breaks tracking for static file paths during the rotation window because the agent might not monitor the renamed files.
Understanding the root cause is necessary to configure the correct file monitoring settings.
2
Modify the agent configuration file to use wildcards.
Setting the file_path to /var/log/app/current.log* enables the agent to match both the active and renamed log files.
Using a wildcard pattern ensures the agent tracks rotated files during the transition window.
3
Deploy the updated configuration file and restart the CloudWatch agent.
The agent continuously monitors and sends logs without loss during rotation.
Applying the changes enables the agent to start tracking the files using the new wildcard path pattern.

Anahtar Kavram

Configuring the Unified CloudWatch Agent for Log Rotation using Wildcards
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging