How to Search a Year of EC2 Error Logs in CloudWatch?
A company runs a non-production application on an Amazon EC2 instance. The application logs all error messages to a log file on the local file system. All entries that are written to the log file start with the word "error." A CloudOps engineer must implement a solution that gives the company the ability to search for all occurrences of the error during the previous year. Which solution will meet this requirement?
Community Insight
The exam tests durable log collection plus long-term searchability; the trap is choosing SQS or S3 event notifications, which move messages or events but do not provide a queryable one-year log archive.
This SOA-C03 scenario tests whether you can retain and search EC2 application error logs for a full year using the CloudWatch agent and CloudWatch Logs. It establishes that option A is correct because the agent streams the local log file to a log group whose retention can be set to 365 days and queried with CloudWatch Logs Insights.
Candidates often pick S3 or SQS because they think any storage service can hold logs for a year, but SQS retains messages for at most 14 days and S3 event notifications carry event metadata, not searchable log contents.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A uses the Amazon CloudWatch agent, which is the supported way to collect a local application log file from an EC2 instance and stream it to a CloudWatch Logs log group. The log group is the durable, searchable store: set its retention to 365 days so entries from the previous year remain available, then use CloudWatch Logs Insights to search for every event containing "error." The metric filter in option A is optional for counting matching events, but it does not replace the log group's retention and query capability. Because A is the only choice that places the raw log events in a queryable AWS log store with configurable one-year retention, it satisfies the requirement.Why the Other Options Are Wrong
Option B says to have the CloudWatch agent send an Amazon SNS message to a CloudWatch Logs log group, which is not a valid ingestion path; SNS is a notification service, not a producer into a log group. Option C sends the messages to an Amazon SQS queue and uses Lambda to inspect them, but SQS retains messages for at most 14 days and the design provides no one-year searchable archive of the raw log lines. Option D stores objects in Amazon S3 and creates an S3 event notification to SQS, yet the notification carries event metadata rather than the object contents, and SQS's 14-day retention still blocks year-long search. None of B, C, or D offers the direct CloudWatch Logs search that the requirement describes.Community Comment Notes
Bad_Mat chose A and described the CloudWatch agent as the "standard AWS mechanism to continuously collect log files" from the instance and stream them to CloudWatch Logs, with a metric filter matching "error." That aligns with the ingestion and filtering portions of the correct design. The comment focuses on the metric filter, so remember that searching is performed against the log group itself, while the metric filter is an optional metric-generation layer. No commenter presents a workable case for SQS or S3 event notifications.Official Reference
Exam Strategy
Look for the service that both ingests the log file and supports long-term, queryable retention. Reject options where SQS is the retention layer, because its maximum message retention is 14 days, and verify that the log destination is a CloudWatch Logs log group, not an SNS topic.
Frequently Asked Questions
Why is the CloudWatch metric filter alone not enough for year-long search?
A metric filter converts matching log events into CloudWatch metrics; the searchable raw events and their retention live in the CloudWatch Logs log group, which must be kept for 365 days.
Can Amazon SQS store the error messages for a full year in option C?
No. SQS message retention is capped at 14 days, so an SQS and Lambda design cannot provide a one-year archive for searching.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →