Examkin

Soru

Zorluk: OrtaImproving Operational Excellence via Monitoring and Logging

An enterprise is running a web application on a fleet of Amazon EC2 instances. The application writes transaction logs to a local file at /var/log/app/production.log. These logs are rotated daily, renamed with a timestamp suffix, and compressed. The solutions architect needs to design a solution that continuously collects these logs, monitors them in real-time for specific error patterns, and archives them to a centralized Amazon S3 bucket in a security account. Which combination of steps should the solutions architect recommend to meet these requirements with the least administrative overhead? (Select TWO.)

  1. Install the Unified CloudWatch Agent on the EC2 instances, and configure the agent configuration file with /var/log/app/production.log* in the file_path parameter under the logs section.Cevap
  2. Create an Amazon Kinesis Data Firehose delivery stream in the application account to deliver logs to the S3 bucket in the security account, and configure a CloudWatch Logs subscription filter to forward the logs to the delivery stream.Cevap
  3. C
    Install the Unified CloudWatch Agent on the EC2 instances, and configure the agent configuration file with /var/log/app/production.log in the file_path parameter, relying on the agent to track file descriptor changes during log rotation.
  4. D
    Create a CloudWatch Logs export task to export the logs directly to the S3 bucket in the security account, and configure the S3 bucket policy in the security account to trust the CloudWatch Logs service principal from the application account.

Cevap

Configure the Unified CloudWatch Agent with the wildcard pattern /var/log/app/production.log* in the file_path parameter, and stream the logs using a CloudWatch Logs subscription filter to an Amazon Kinesis Data Firehose delivery stream targeting the centralized S3 bucket.
To continuously collect logs and monitor them in real-time, the solutions architect must configure the CloudWatch Agent to capture rotated files and establish a real-time streaming pipeline. Using the wildcard pattern /var/log/app/production.log* in the agent configuration ensures that both the active log file and rotated files are monitored. Utilizing a CloudWatch Logs subscription filter to stream logs to an Amazon Kinesis Data Firehose delivery stream enables real-time cross-account transmission to the centralized Amazon S3 bucket.

Adım Adım Çözüm

1
Configure the CloudWatch agent on the EC2 instances to track the log files using a wildcard suffix.
The agent monitors both /var/log/app/production.log and any rotated files like /var/log/app/production.log.2026-07-16.
Without the wildcard suffix, the agent ceases tracking logs after rotation occurs.
2
Create an Amazon Kinesis Data Firehose delivery stream that points to the centralized S3 bucket in the security account.
A delivery stream is prepared to ingest real-time log data and upload it to the cross-account destination.
Firehose handles cross-account delivery, buffering, and compression with minimal management overhead.
3
Apply a subscription filter to the CloudWatch Logs log group to route logs to the Kinesis Data Firehose delivery stream.
Logs are streamed in real-time as they are ingested by CloudWatch Logs.
This enables both real-time monitoring within CloudWatch Logs (metric filters) and automated archiving to the central bucket.

Anahtar Kavram

Configuring the Unified CloudWatch Agent with wildcard file paths for rotated logs, and streaming logs cross-account using CloudWatch Logs subscription filters and Kinesis Data Firehose.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging