DOP-C02 Question 209
Select 2Your company has a distributed application running on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs are stored locally on the EC2 instances, and you need to centralize the logs for monitoring and analysis. You decide to use Amazon CloudWatch Logs for this purpose. How should you configure the log collection and ensure they are aggregated in CloudWatch Logs?
- A
Install the CloudWatch agent on each EC2 instance and configure it to stream the application logs to a CloudWatch Logs log group.
- B
Enable access logging on the Application Load Balancer and configure it to send logs to an Amazon S3 bucket.
- C
Set up an Amazon EventBridge rule to capture EC2 instance logs and forward them to CloudWatch Logs.
- D
Create a CloudWatch Logs subscription filter to process the logs and forward them to an Amazon Kinesis Data Firehose delivery stream.
- E
Configure AWS Systems Manager Session Manager to forward the logs from the EC2 instances to CloudWatch Logs.
Show answer and explanation
Correct answers: A, B
Explanation
To centralize logs from EC2 instances to CloudWatch Logs, you should install the CloudWatch agent on the instances and configure it to stream logs to a CloudWatch Logs log group. Additionally, enabling access logging on the ALB and storing those logs in S3 provides complementary insights into application traffic patterns. EventBridge, subscription filters, and Session Manager are not appropriate tools for collecting or aggregating logs in this scenario.
- A. Correct.
Correct. Installing the CloudWatch agent on EC2 instances allows you to collect application logs and stream them to CloudWatch Logs for centralized monitoring and analysis.
- B. Correct.
Correct. Enabling access logging on the ALB and sending logs to an S3 bucket provides additional logging data (e.g., ALB-level access logs) that complements the EC2 instance logs and aids in troubleshooting.
- C. Incorrect.
Incorrect. Amazon EventBridge is not designed to capture logs directly from EC2 instances. It is used for event-driven architectures and does not facilitate direct log aggregation from EC2 instances to CloudWatch Logs.
- D. Incorrect.
Incorrect. A subscription filter in CloudWatch Logs is used to process existing logs in a log group, not to collect or aggregate logs from EC2 instances.
- E. Incorrect.
Incorrect. AWS Systems Manager Session Manager facilitates secure shell access to EC2 instances, but it is not meant for log collection or forwarding logs to CloudWatch Logs.