An organization is running a legacy application on Amazon EC2 instances. The CloudWatch agent is configured to collect application logs from a static path of /var/log/app/app.log. The application rotates its logs hourly by renaming the active log file to /var/log/app/app.log.YYYY-MM-DD-HH and creating a new empty /var/log/app/app.log file. The operations team notices that the CloudWatch agent ceases log ingestion after the first log rotation occurs. Which configuration change will resolve this issue and ensure continuous log ingestion?
- Modify the CloudWatch agent configuration file to use a wildcard pattern (e.g., /var/log/app/app.log*) in the file_path setting to monitor both the active and rotated files.Cevap
- BMaintain the static path /var/log/app/app.log in the configuration file, relying on the agent's default file tracking to automatically detect renamed files based on their inode.
- CAttach a Service Control Policy (SCP) to the account's Organizational Unit to grant log write permissions directly to the EC2 instances, bypassing local IAM policies.
- DCreate an Amazon S3 bucket policy in a centralized logging account that allows log delivery, but omit the specific account principal and organizational ID conditions.
Cevap
Modify the CloudWatch agent configuration file to use a wildcard pattern (e.g., /var/log/app/app.log*) in the file_path setting to monitor both the active and rotated files.
The correct answer is to modify the CloudWatch agent configuration to use a wildcard pattern. This allows the agent to monitor the directory for both the active and rotated files, ensuring that new files are detected and ingested without interruption.
Adım Adım Çözüm
Anahtar Kavram
Configuring the Unified CloudWatch Agent log paths using wildcard patterns to support log rotation and avoid data loss.