QUESTION 1

Due to compliance regulations, management has asked you to provide a system that allows for cost-effective long-term storage of your application logs and provides a way for support staff to view the logs more quickly. Currently, your log system archives log automatically to Amazon S3 every hour, and support staff must wait for these logs to appear in Amazon S3 because they do not currently have access to the systems to view live logs.

What method should you use to become compliant while also providing a faster way for support staff to have access to logs?

A. Update Amazon S3 lifecycle policies to archive old logs to Amazon Glacier, and add a new policy to push all log entries to Amazon SQS for ingestion by the support team.

B. Update Amazon S3 lifecycle policies to archive old logs to Amazon Glacier, and use or write a service to stream your application logs to CloudWatch Logs.

C. Update Amazon Glacier lifecycle policies to pull new logs from Amazon S3, and in the Amazon EC2 console, enable the CloudWatch Logs Agent on all of your application servers.

D. Update Amazon S3 lifecycle policies to archive old logs to Amazon Glacier. The key can be different from the table Enable Amazon S3 partial uploads on your Amazon S3 bucket, and trigger an Amazon SNS notification when a partial upload occurs.

E. Use or write a service to stream your application logs to CloudWatch Logs. Use an Amazon Elastic Map Reduce cluster to live stream your logs from CloudWatch Logs for ingestion by the support team, and create a Hadoop job to push the logs to S3 in five-minute chunks.

分析：

第一个需要关注的点是：节省成本，长期存放

我已经将需要注意的关键字高亮: cost-effective, long-term. 当谈到日志存储，第一个反应出来的AWS service 就是S3. 它有lifecycle 能够确保热度不高或者不经常访问的日志文件能够使用 Amazon Glacier来处理，来换取更低的存储费用。所以通过这一条可以排除答案E,因为E的关于日志的存储策略过去复杂，而且成本较高。

第二个需要关注的点是：支持团队能够迅速查看应用日志

答案A：制定一个新的策略把所有的日志都发送到SQS消息队列。这个方式存在两个问题：

1.所有日志的范围过于广泛，对应support团队比较关心一些核心的应用日志，并不是所有的日志，这样反而造成troubleshooting过程的繁琐，已经较高的成本；

2.发日志到SQS,下游还需要对应的处理逻辑，所以不是一个完成的解决方案。

结论：pass

答案B: 开发一个将应用日志转发到cloudwatch log的服务，然后support team可以直接使用cloudwathc log 来查看应用日志；

结论： 正确

答案C:此答案有如下不确定：

1.不确定应用所运行的EC2是否可以直接在console来安装Cloudwatch Logs agent;

2.Cloudwatch Logs agent 需要配置收集哪些应用日志需要配置，此处并没有提到.

结论 ：pass

答案D:此方案并没有解决support团队能够更快访问日志的问题。

结论：pass