Examkin

Soru

Zorluk: KolayCloudWatch Logs and Metric Filters

A SysOps Administrator needs to monitor an application log group in Amazon CloudWatch Logs. The administrator wants to receive an email notification whenever the keyword "Failed" appears in the logs. Which two configuration steps must the SysOps Administrator perform to set up this monitoring and notification? (Select TWO.)

  1. Create a metric filter on the log group with the filter pattern "Failed" to map log occurrences to a custom metric.Cevap
  2. Create a CloudWatch alarm based on the custom metric and configure it to send a notification to an Amazon SNS topic.Cevap
  3. C
    Configure a subscription filter on the log group to stream the log events directly to an Amazon SNS topic.
  4. D
    Enable detailed monitoring on the EC2 instances hosting the application to increase the log parsing frequency to 1-minute intervals.
  5. E
    Modify the log retention policy of the log group to 1 day to trigger notifications on expired log streams.

Cevap

Create a metric filter on the log group with the filter pattern "Failed" to map log occurrences to a custom metric, and create a CloudWatch alarm based on the custom metric and configure it to send a notification to an Amazon SNS topic.
To alert on specific log events in CloudWatch Logs, you must first create a metric filter on the target log group. The filter matches the specified term (in this case, "Failed") and outputs a numeric metric. You then create a CloudWatch alarm that evaluates this custom metric and sends a notification to an Amazon SNS topic when the threshold is breached.

Adım Adım Çözüm

1
Define a Metric Filter on the CloudWatch Log Group.
A custom metric is created under a specific namespace that increments by 1 whenever the keyword "Failed" is matched in the incoming log events.
Metric filters parse log data in real-time to convert text patterns into numerical CloudWatch metrics.
2
Create a CloudWatch Alarm for the newly created custom metric.
An alarm is defined to monitor the custom metric, transitioning to the ALARM state when the count of "Failed" events exceeds the threshold.
Alarms are required to evaluate metric values over time and trigger actions when thresholds are crossed.
3
Configure the Alarm Action to send a notification.
An Amazon Simple Notification Service (SNS) topic is configured as the target, sending an email notification to the administrator.
SNS topics distribute notifications to subscribed endpoints when the alarm state transitions.

Anahtar Kavram

Using CloudWatch Logs Metric Filters and Alarms to detect and alert on log patterns.
Bu soruyu puanla

Konular

CloudWatch Logs and Metric Filters

Bu konudan daha fazla soru