Logs Insights, Athena and dashboards: DOP-C02 study notes and practice questions
What to know about Logs Insights, Athena and dashboards for the DOP-C02 exam, from the Monitoring and Logging domain (15% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
These questions ask which tool answers a question about logs fastest, given where the logs are and how old they are.
Tools
Tool
Best for
CloudWatch Logs Insights
Interactive queries over log groups in CloudWatch, several at once; filter, stats count() by bin(1h), parse; saved queries; also OpenSearch PPL and SQL syntaxes
Amazon Athena
SQL over archived logs in S3 (Parquet, partitioned, with partition projection); ALB, CloudFront, VPC Flow Logs and CloudTrail logs
Amazon OpenSearch Service
Full-text search, near real-time dashboards (OpenSearch Dashboards), long retention of searchable logs
CloudWatch Contributor Insights
Top-N contributors, such as the IPs or users causing most errors
CloudTrail Lake
SQL over API activity events, with long retention
CloudWatch Logs anomaly detection and pattern analysis
Spotting unusual log patterns without writing queries
Dashboards
CloudWatch dashboards combine metrics, alarms and Logs Insights results; can be cross-account and cross-Region and shared.
Amazon Managed Grafana for teams that use Grafana.
Amazon Quick Sight for business-facing reports from Athena.
Choosing by the clue
“Last 30 days, in CloudWatch, hourly counts”: Logs Insights.
“Seven years of archived logs in S3, auditors want SQL”: Athena.
“Free-text search and live dashboards across services”: OpenSearch.
“Which client causes the most throttling”: Contributor Insights.
Cost tips
Query only the log groups and time range you need; store archives as compressed, partitioned Parquet.
Common traps
Exporting logs to S3 to run a quick query on recent data.
Keeping years of logs in CloudWatch for occasional audits instead of archiving to S3.
Building dashboards by hand in each account when cross-account observability exists.
A hospital network keeps application logs for two years for audit. The last 30 days of logs are in CloudWatch Logs, and older logs are in an S3 bucket in Parquet format, partitioned by date and hospital site.
Auditors need to run ad-hoc SQL queries that count access events by user across the archived logs, and the on-call engineers need a saved query over the last 30 days to investigate alerts quickly.
The team wants to use managed query services and avoid loading the archive into another database.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Create an Amazon Athena table over the S3 bucket and use partition projection on the date and site columns, so that auditors query the archive directly with SQL.
BB. Export the whole archive back into a CloudWatch log group every time an audit starts, so that Logs Insights can scan all two years in one query.
CC. Save a Logs Insights query over the last 30 days of the application log group, and have the on-call engineers run it from the console when an alert arrives.
DD. Load the archive into an Amazon RDS database each night, and have the auditors query that database with SQL, so that the archive becomes ordinary tables.
EE. Turn on CloudWatch Contributor Insights rules for the log group, so that it counts access events by user for the auditors over the full two years automatically.
Athena queries the Parquet archive in place, and partition projection keeps scans small, so auditors can run SQL over the archived history. Logs Insights queries the recent 30 days in CloudWatch, and a saved query gives the on-call engineers a repeatable investigation. Re-exporting the archive, loading a database and Contributor Insights each add data movement or miss the archive.
A video streaming service's playback API writes JSON logs to three CloudWatch Logs log groups in one Region, one per microservice. During an incident, an on-call engineer needs to see the count of each error code per hour across all three groups for the last six hours.
The engineer needs the result in the console within a minute, without moving any logs or writing a new pipeline, and the query should be reusable during the next incident. The engineer should not need to know which microservice produced an error.
Which approach meets these requirements?
Choose one answer.
AA. Export the three log groups to an S3 bucket, create an Athena table over the exported files, and run a SQL query that groups the error codes by hour.
BB. Use a Lambda function that reads the log events with the GetLogEvents API, counts the error codes in memory and prints the totals to a file the engineer can download.
CC. Select the three log groups in Logs Insights, run a query that filters errors and counts them by error code in hourly bins, and save the query.
DD. Create a metric filter for each error code in each log group, and open the metric graphs in the console, which show the counts per hour for the last six hours.
CloudWatch Logs Insights queries several log groups in place, and a query that groups and bins the results returns the hourly error counts directly in the console. Saving it lets the team reuse it. Exports, custom pipelines and metric filters that were not created in advance each add delay or work the team did not ask for.
Want more on Logs Insights, Athena and dashboards? The 5 full-length practice sets have 12 more Logs Insights, Athena and dashboards questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →