SOA-C02 Question 22
Single answerYour company uses AWS CloudWatch Logs to monitor application logs generated by an EC2 instance. You are tasked with setting up a CloudWatch Logs metric filter to detect and count occurrences of the word 'ERROR' in the logs. After creating the metric filter, you notice that the expected metrics are not visible in CloudWatch Metrics. What could be the cause of this issue?
- A
The metric filter pattern does not match the log event format.
- B
The IAM role associated with the CloudWatch Logs group does not have permissions to write to CloudWatch Metrics.
- C
The EC2 instance is not configured to send logs to the CloudWatch Logs group.
- D
The metric filter is configured but has not been associated with a CloudWatch alarm.
Show answer and explanation
Correct answer: A
Explanation
The issue arises because the metric filter pattern must match the format of the log events. If the pattern is incorrect or does not align with the structure of the log messages, the metric filter will not be able to detect the desired occurrences. This is a common issue when configuring metric filters without validating the pattern against the actual log format.
- A. Correct.
If the metric filter pattern does not match the format of the log events, the metric filter will not detect any occurrences, and no metrics will be generated.
- B. Incorrect.
CloudWatch Logs metric filters do not require an IAM role to write to CloudWatch Metrics. Metrics are created automatically once the filter matches log events.
- C. Incorrect.
While logs need to be sent to a CloudWatch Logs group for the metric filter to work, this is unrelated to the issue described, as the question assumes logs are already in the group.
- D. Incorrect.
A metric filter does not need to be associated with a CloudWatch alarm to generate metrics. Alarms are optional and only used for additional monitoring or alerting.