AWS Certified SysOps Administrator – AssociateMonitoring, Logging, and RemediationMedium
A SysOps administrator needs to analyze the performance of a new web application deployed on Amazon EC2 instances. The application uses a custom logging format and generates high volumes of logs. The administrator wants to centralize these logs for real-time analysis and historical archiving without managing any servers for the logging solution. Which AWS service combination should be used?
- AConfigure Amazon SQS to receive logs from EC2 instances and then use a Lambda function to process and store them in Amazon DynamoDB.
- BUse AWS Systems Manager to collect logs from EC2 instances and store them in Amazon Glacier.
- CAWS CloudWatch Logs Agent on EC2 instances sending logs to CloudWatch Logs, then streaming to Amazon Kinesis Firehose for S3 archiving.
- DInstall Fluentd on EC2 instances to send logs directly to an Amazon S3 bucket for archiving.
Show answer & explanationAnswer & explanation
Correct answer: C. AWS CloudWatch Logs Agent on EC2 instances sending logs to CloudWatch Logs, then streaming to Amazon Kinesis Firehose for S3 archiving.
The CloudWatch Logs Agent can collect custom logs from EC2 instances. CloudWatch Logs provides real-time analysis capabilities. Kinesis Firehose can then reliably stream these logs from CloudWatch Logs to S3 for cost-effective, long-term archiving, and the entire solution is serverless for the logging infrastructure.
Why the other options are wrong
- A. SQS is a message queue, not ideal for direct log ingress from an agent. DynamoDB is a NoSQL database, not cost-effective or designed for raw, high-volume log archiving and analysis.
- B. Systems Manager is primarily for operational tasks and automation, not a primary log collection and archiving service for high-volume custom logs. Glacier is for archival, not real-time analysis.
- D. Fluentd can send logs, but sending directly to S3 doesn't provide real-time analysis capabilities in a centralized manner without additional services.
Centralized Custom Log Management
Collect custom application logs from EC2 instances, centralize them for real-time analysis, and archive them cost-effectively using serverless AWS services.
- CloudWatch Logs Agent for collection
- CloudWatch Logs for real-time analysis and storage
- Kinesis Firehose for streaming to S3 for archiving
Memory trick: Agent gathers logs, CloudWatch analyzes, Firehose archives to S3.