Question

A CloudOps engineer manages a fleet of 200 EC2 instances running a Java application. The team wants to centralize application logs in CloudWatch Logs and set an alarm when the number of ERROR entries exceeds a threshold across the fleet. The engineer must minimize custom code and ongoing maintenance. Which approach meets these requirements?

Accepted Answer

Install the CloudWatch agent to stream the application log file to a log group, create a metric filter that matches the ERROR pattern, and set a CloudWatch alarm on the resulting metric.

Answer

Write a cron job on each instance that greps for ERROR and calls PutMetricData with a custom metric, then alarm on the metric.

Answer

Create a Lambda function triggered every minute that connects to each instance via SSM Run Command to read the log file and count ERROR lines.

Answer

Enable EC2 detailed monitoring and create a CloudWatch alarm on the ApplicationErrors metric emitted automatically for each instance.