{"id":18343,"date":"2015-03-20T15:04:22","date_gmt":"2015-03-20T09:34:22","guid":{"rendered":"http:\/\/www.tothenew.com\/blog\/?p=18343"},"modified":"2015-03-21T20:11:36","modified_gmt":"2015-03-21T14:41:36","slug":"logs-monitoring-using-aws-cloudwatch","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/logs-monitoring-using-aws-cloudwatch\/","title":{"rendered":"Logs Monitoring Using AWS CloudWatch"},"content":{"rendered":"
\n

\u00a0<\/b><\/span><\/span>Suppose, you have multiple servers running a simple web application on apache or Nginx and you want to put all the error\/access logs on a centralized place so that you can troubleshoot your system in case of any error after getting alert notification configured on your logs .<\/p>\n

Here is an amazing feature of Amazon Web Services Cloud Suite by which you can achieve this task.<\/p>\n

Amazon CloudWatch now provides us the flexibility to monitor, maintain, store and access our custom log files, log files from EC2 Servers, CloudTrail and other resources. We can also generate alerts on those logs. This will help us in troubleshooting our servers by monitoring all the appplication-specific logs on CloudWatch in real time.<\/p>\n

\"Untitled<\/a><\/p>\n

Implementation:-<\/h3>\n

Step 1<\/strong><\/span>\u00a0:-<\/strong><\/p>\n

Firstly we need two policies attached to an IAM role which we will assign to EC2 instances so that the logs from the instances can be pushed to the CloudWatch.<\/p>\n

There is a need of an CloudWatch agent which will do the task to push logs onto the CloudWatch.An agent-configuration file is necessary which we can store in our S3 bucket and at the time of launching an instance we will use that agent-configuration file.<\/p>\n

The two necessary policies are :-<\/p>\n

 <\/p>\n

Policy 1\u00a0:-<\/h3>\n

This policy will allow your EC2 instance to access the agent-configuration file stored in your S3 bucket.Here you would give the name of your S3 bucket.<\/p>\n

{\u00a0\u00a0
\u00a0\u00a0\u00a0“Version”:”2012-10-17″,
\u00a0\u00a0\u00a0“Statement”:[\u00a0\u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{\u00a0\u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Effect”:”Allow”,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Action”:[\u00a0\u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“logs:*”,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“s3:GetObject”
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0],
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Resource”:[\u00a0\u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“arn:aws:logs:*:*:*”,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“arn:aws:s3:::your_bucket_name\/*”
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0]
}<\/p>\n

Policy 2\u00a0:-<\/h3>\n

This policy will allow your EC2 instance to push the log file stored in your CloudWatch.So here I am assigning all the permissions to my EC2 instance so that it can create log group,log stream and other necessary files.<\/p>\n

{<\/p>\n

“Version”:”2012-10-17″,”Statement”:[<\/p>\n

{\u00a0\u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Effect”:”Allow”,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Action”:[\u00a0\u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“logs:*”
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0],
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“Resource”:[\u00a0\u00a0
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0“arn:aws:logs:*:*:*”
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0]
}<\/p>\n

 <\/p>\n

So create an IAM role and assign two policies to it and at the time of launching EC2 instance you will be assigning this role to your EC2 instance.<\/p>\n

Step 2<\/strong><\/span>\u00a0:-\u00a0<\/strong>Understanding Agent-Configuration File (stored on S3)<\/strong><\/p>\n

Now, create an agent configuration file Cloudwatch_agent_conf \u00a0and paste the content of \u00a0following file \u00a0and edit it accordingly and upload it to your S3 bucket.<\/p>\n

[general]
\nstate_file = \/var\/awslogs\/state\/agent-state<\/p>\n

[\/var\/log\/syslog]
\nfile = \/var\/log\/nginx\/access.log
\nlog_group_name = nginx_server
\nlog_stream_name = nginx_access_logs
\ndatetime_format = %b %d %H:%M:%S<\/p>\n

 <\/p>\n

Parameters in agent-configuration file\u00a0:-<\/strong><\/h3>\n

1.file :-\u00a0<\/strong>The file specifies the file in which your actual logs are stored on your EC2 instances. This is the log file whose content you want to push on CloudWatch logs . I want to push my nginx access logs onto the CloudWatch so I am specifiying the path of nginx access log file.<\/p>\n

2.log_group_name :-\u00a0<\/strong>It refers to the destination log group. A log group will be created automatically if no log group exists in your CloudWatch.<\/p>\n

3.log_stream_name :-\u00a0<\/strong>It refers to the destination log stream.A log stream can be {instance_id}, {hostname}, {ip_address} or a combination of these.<\/p>\n

4.datetime_format :-\u00a0<\/strong>It specifies how the timestamp is extracted from logs.<\/p>\n

%b specifies month (Jan,Feb..)<\/p>\n

%d specifies\u00a0day of month (01,02..)<\/p>\n

%H specifies Hour (24-hour clock)<\/p>\n

%M specifies Minutes (01,02..59)<\/p>\n

%S specifies Seconds (01,02..59)<\/p>\n

 <\/p>\n

Step 3<\/strong><\/span>\u00a0:-\u00a0<\/strong>Now, we need a script which we can pass in the User data at the time of launching an EC2 instance which will make all the configurations for CloudWatch agent to push logs to the CloudWatch.<\/p>\n

#!\/bin\/bash
\nwget https:\/\/s3.amazonaws.com\/aws-cloudwatch\/downloads\/latest\/awslogs-agent-setup.py<\/p>\n

chmod +x .\/awslogs-agent-setup.py<\/p>\n

\n

\u00a0.\/awslogs-agent-setup.py -n -r us-east-1 -c s3:\/\/your_bucket_name\/Cloudwatch_agent_conf<\/p>\n

\n

\u00a0sudo service awslogs restart<\/p>\n<\/div>\n<\/div>\n

Step 4<\/strong><\/span>\u00a0:-\u00a0<\/strong>We are almost done with the configuration . Now, launch a new EC2 instance, assign it the IAM role with two policies which you have created above and pass the above script as a userdata to the instance.<\/p>\n

You can also append other packages’ installation steps after these lines in userdata script like installation of nginx or apache.<\/p>\n

Now go to your AWS CloudWatch console.Go to \u201cLogs\u201d in Dashboard, you will be able to see the log group name which you mentioned in your agent-configuration file.<\/p>\n

 <\/p>\n

SNS Integration on Logs to create alerts<\/h3>\n

Step 1<\/strong><\/span>\u00a0:-\u00a0<\/strong>Go to the Log Groups in your AWS CloudWatch console .Click on Create Metric Filter.\"cw1\"<\/a><\/p>\n

Step 2<\/strong><\/span>\u00a0:-<\/strong>\u00a0Now, you can set pattern to be searched in logs.<\/p>\n

For Example, I want to create alarm according to my GET requests.Click on Assign Metric.<\/p>\n

\"cw2\"<\/p>\n

Step 3<\/strong><\/span>\u00a0:-\u00a0<\/strong>Now, assign a metric to your metric filter.<\/p>\n

\"cw3\"<\/p>\n

Step 4<\/strong><\/span>\u00a0:-\u00a0<\/strong>Your metric filter is created.Now click on Create Alarm .<\/p>\n

\"cw4\"<\/p>\n

Step 5\u00a0<\/strong><\/span>:-\u00a0<\/strong>Here you can create alarm by setting thresholds and ARN for your SNS.<\/p>\n

\"cw5\"<\/p>\n

Finally your alarms are configured on your logs.You can check your alarms in CloudWatch alarms.<\/p>\n<\/div>\n

<\/div>\n
<\/div>\n","protected":false},"excerpt":{"rendered":"

\u00a0Suppose, you have multiple servers running a simple web application on apache or Nginx and you want to put all the error\/access logs on a centralized place so that you can troubleshoot your system in case of any error after getting alert notification configured on your logs . Here is an amazing feature of Amazon […]<\/p>\n","protected":false},"author":170,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":19},"categories":[1174],"tags":[1262,1547,1694,1696,1695],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/18343"}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/170"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=18343"}],"version-history":[{"count":0,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/18343\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=18343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=18343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=18343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}