SOA-C02 Question 21
Select 3An organization is using Amazon CloudWatch Logs to monitor application logs and identify specific error messages. The SysOps Administrator wants to create a CloudWatch alarm that triggers whenever the phrase 'ERROR 500' appears in the logs. What steps must the administrator take to achieve this?
- A
Create a CloudWatch Logs metric filter with the pattern 'ERROR 500' and associate it with the relevant log group.
- B
Define an IAM policy that grants the CloudWatch service permissions to read the application logs.
- C
Create a CloudWatch alarm based on the metric filter to monitor occurrences of 'ERROR 500'.
- D
Set the metric filter output as a custom metric and use it as the basis for the CloudWatch alarm.
- E
Enable detailed monitoring for the EC2 instances running the application to access the logs.
Show answer and explanation
Correct answers: A, C, D
Explanation
To monitor specific log patterns like 'ERROR 500' and trigger alarms, you must create a CloudWatch Logs metric filter to search for the desired pattern and convert it into a custom metric. Then, create a CloudWatch alarm based on that custom metric to define thresholds and trigger notifications. IAM permissions and EC2 detailed monitoring are not directly relevant to this task.
- A. Correct.
Correct: Creating a CloudWatch Logs metric filter with the pattern 'ERROR 500' is required to extract and count occurrences of the specific log pattern.
- B. Incorrect.
Incorrect: While IAM permissions are important, this step is not directly related to creating a CloudWatch metric filter or alarm.
- C. Correct.
Correct: A CloudWatch alarm must be created to monitor the custom metric generated by the metric filter and trigger alerts when the threshold is breached.
- D. Correct.
Correct: The metric filter outputs a custom metric that serves as the basis for the CloudWatch alarm.
- E. Incorrect.
Incorrect: Enabling detailed monitoring for EC2 provides instance-level performance metrics and is unrelated to log monitoring with metric filters.