Question

A developer runs a Java application on Amazon EC2 that writes plain-text logs to a CloudWatch Logs log group. Operations wants to be paged whenever the phrase "OutOfMemoryError" appears more than 3 times within a 5-minute window. There is currently no numeric metric that tracks these occurrences. What is the most appropriate way to enable this alerting with the least custom code?

Accepted Answer

Create a CloudWatch Logs metric filter that matches "OutOfMemoryError" and increments a custom metric, then create a CloudWatch alarm on that metric with a threshold of 3 over a 5-minute period.

Answer

Enable CloudWatch Logs Insights scheduled queries to count occurrences and configure the query to publish an SNS notification directly when the count exceeds 3.

Answer

Add the CloudWatch agent to the instance and configure it to emit an alarm whenever it detects the "OutOfMemoryError" string in the log stream.

Answer

Create an EventBridge rule that pattern-matches the "OutOfMemoryError" log events delivered from CloudWatch Logs and triggers an SNS topic after 3 matches.