Which is the MOST efficient and cost-effective solution?
Collect system logs and application logs by using the Amazon CloudWatch Logs agent. Use the Amazon S3 API to export on-premises logs, and store the logs in an S3 bucket in a central account. Build an Amazon EMR cluster to reduce the logs and derive the root cause.
Collect system logs and application logs by using the Amazon CloudWatch Logs agent. Use the Amazon S3 API to import on-premises logs. Store all logs in S3 buckets in individual accounts. Use Amazon Macie to write a query to search for the required specific event-related data point.
Collect system logs and application logs using the Amazon CloudWatch Logs agent. Install the CloudWatch Logs agent on the on-premises servers. Transfer all logs from AWS to the on-premises data center. Use an Amazon Elasticsearch Logstash Kibana stack to analyze logs on premises.
Collect system logs and application logs by using the Amazon CloudWatch Logs agent. Install a CloudWatch Logs agent for on-premises resources. Store all logs in an S3 bucket in a central account. Set up an Amazon S3 trigger and an AWS Lambda function to analyze incoming logs and automatically identify anomalies. Use Amazon Athena to run ad hoc queries on the logs in the central account.
Explanations:
While using Amazon S3 for storage is a good option, building an Amazon EMR cluster to analyze logs is a costly and inefficient solution for log aggregation and troubleshooting. EMR is better suited for large-scale data processing, not log analysis in this scenario.
Storing logs in S3 buckets across individual accounts introduces complexity and overhead for log aggregation. Using Amazon Macie for log queries is more suited for sensitive data discovery, not log analysis, making this option inappropriate for troubleshooting.
This option involves transferring logs from AWS to on-premises, which complicates the process and introduces latency. Analyzing logs on-premises with Elasticsearch adds unnecessary complexity and does not provide a centralized and scalable solution.
This option centralizes logs in an S3 bucket in a central account, using the CloudWatch Logs agent and AWS Lambda for automated log analysis. Amazon Athena enables ad hoc queries, which is an efficient and cost-effective solution for log aggregation and troubleshooting.
As far as I’m aware, the answer is:
Collect system logs and application logs by using the Amazon CloudWatch Logs agent. Install a CloudWatch Logs agent for on-premises resources. Store all logs in an S3 bucket in a central account. Set up an Amazon S3 trigger and an AWS Lambda function to analyze incoming logs and automatically identify anomalies. Use Amazon Athena to run ad hoc queries on the logs in the central account.