把 AP 的 Log 從機器送到 Log 服務，一直以來都是很重要的課題，這樣功能的角色稱為 Log Shipper。CloudWatch 提供的第一個版本的 Log Shipper 服務：awslogs

awslogs (python)

Log 蒐集部分，需要在 EC2 Instance 安裝 agent，底下是快速安裝：

1
2
3

curl https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -O
chmod +x ./awslogs-agent-setup.py
./awslogs-agent-setup.py -n -r ap-northeast-1 -c s3://<bucket-name>/awslogs.conf

記得先在 s3 放一個 config 檔，或者直接執行安裝檔。

安裝好 awslogs agent，然後設定 Filename Pattern、Time Format、Log Group、Log Stream … 等，就會自動把 Log 傳到 CloudWatch Log，詳細設定：CloudWatch Logs Agent Reference。

底下是我蒐集 syslog + nginx 設定例子：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# see: http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html
[general]
state_file = /var/awslogs/state/agent-state

[/var/log/syslog]
file = /var/log/syslog
log_group_name = /Worker/SysLog
log_stream_name = {instance_id}_{hostname}
datetime_format = %b %d %H:%M:%S

[/var/log/nginx/log]
file = /var/log/nginx/*.log
log_group_name = /Worker/Nginx
log_stream_name = AccessLog
datetime_format = %Y-%m-%dT%H:%M:%S%z
time_zone = UTC

配置 awslogs agent 要注意看 awslogs 自己的 log，確認他的解析是正確的。awslogs 的 log 放在 /var/log/awslogs.log

Windows 則可以透過 Ec2Config 或者 [SSM][2] Windows 自身提供的 Event Logs、Performance Monitoring，或者其他應用程式的 Log ，像是 IIS、 SQLServer 等，傳上去 CloudWatch Log。詳細參閱 [Using CloudWatch Logs with Amazon EC2 Running Microsoft Windows Server][r9]

延伸閱讀

系列文章

• Study Notes - CloudWatch
• Study Notes - CloudWatch Core Functions
• Study Notes - CloudWatch Agent for Linux
• Study Notes - CloudWatch awslogs
• Study Notes - CloudWatch Metrics
• Study Notes - CloudWatch FAQ
• Solution - CloudWatch for Monitoring and Alarm Systems
• Solution - CloudWatch for Log Analysis
• Solution - CloudWatch for Performance Testing
• 2017/06/21: 淺談系統監控與 CloudWatch 的應用 - AWS User Group Taiwan