A logistics company's delivery-tracking service writes one log line per failed delivery attempt to a CloudWatch Logs log group. Dispatchers need an alarm when failed attempts exceed 100 in any five-minute period.
The alarm must go to the on-call channel through SNS, and the service's log format should not change, because other teams read the same lines.
The team wants the alarm built with standard CloudWatch features and no custom monitoring code. The alarm should return to OK on its own once the failures drop.
Which approach meets these requirements?
Choose one answer.
AA. Create a metric filter on the log group that matches failed-attempt lines and publishes a count metric, then create an alarm with a five-minute period and a threshold of 100 that notifies SNS.
BB. Create a CloudWatch Logs Insights query that counts failed attempts and run it every five minutes with a scheduled task, and have the task send a message to SNS when the count is over 100.
CC. Create an alarm on the EC2 CPUUtilization metric for the instances that run the tracking service, because heavy failure rates usually raise CPU use.
DD. Change the service to emit a custom metric through the CloudWatch agent for each failed attempt, and alarm on that metric, while leaving the log group unchanged.
Show the answer and explanation
Answer: A
A. Right: Correct. A metric filter turns matching log lines into a CloudWatch metric without changing the log format, and the alarm evaluates the count over five minutes. The alarm action publishes to the SNS topic for the on-call channel. Learn more: Creating metrics from log events using filters (opens in a new tab)
A metric filter converts matching log lines into a CloudWatch metric, so the existing log format stays the same. An alarm on that metric with a five-minute period and a threshold of 100 can notify SNS directly. Scheduled Logs Insights queries, CPU alarms and changes to the service each add code or miss the failed-attempt count.
Want more on Custom metrics, metric filters and alarms? The 5 full-length practice sets have 14 more Custom metrics, metric filters and alarms questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →