Most frequently Asked Azure CloudWatch Interview Questions

1. What is Azure CloudWatch?
2. What is Cloudwatch Logs?
3. What platforms does the Cloudwatch Logs Agent support?
4. How to get additional lines of context in a CloudWatch Insights query?
5. Does The Cloudwatch Logs Agent Support Iam Roles?
6. How to query Cloudwatch logs using boto3 in python?
7. What operating systems does Cloudwatch support?
8. How long does Cloudwatch Logs store our Data?
9. How can we parse mixed text and JSON log entries in CloudWatch for Log Metric Filter?
10. What does ingestion time mean in CloudWatch?

What is Azure CloudWatch?

Azure CloudWatch is a service for AWS Cloud resources and the applications used to run on AWS, it is also used for collecting and tracking metrics, collect and monitor log files and also in settng alarms.Azure CloudWatch is used for monitoring resources like EC2 instances, DynamoDB tables, And also RDS DB instances.

What is Cloudwatch Logs?

CloudWatch Logs helps in monitoring and troubleshooting our systems and applications by using our existing systems, applications and custom log files, we can also monitor our logs in real time for specific phrases values or patterns.

What platforms does the Cloudwatch Logs Agent support?

Amazon Linux
Ubuntu
CentOS
Red Hat Enterprise Linux
Windows

How to get additional lines of context in a CloudWatch Insights query?

fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 20

Does The Cloudwatch Logs Agent Support Iam Roles?

Yes
CloudWatch Log Agents are icluded with IAM and also includes supports for both, getting admission to keys and IAM roles.

How to query cloudwatch logs using boto3 in python?

For starting a query we would use the following code:

import boto3
from datetime import datetime, timedelta
import time

client = boto3.client('logs')

query = "fields @timestamp, @message | parse @message \"username: * ClinicID: * nodename: *\" as username, ClinicID, nodename | filter ClinicID = 7667 and username='simran+test@abc.com'"  

log_group = '/aws/lambda/NAME_OF_YOUR_LAMBDA_FUNCTION'

start_query_response = client.start_query(
    logGroupName=log_group,
    startTime=int((datetime.today() - timedelta(hours=5)).timestamp()),
    endTime=int(datetime.now().timestamp()),
    queryString=query,
)

query_id = start_query_response['queryId']

response = None

while response == None or response['status'] == 'Running':
    print('Waiting for query to complete ...')
    time.sleep(1)
    response = client.get_query_results(
        queryId=query_id
    )

The results are:

{
  'results': [
    [
      {
        'field': '@timestamp',
        'value': '2019-12-09 17:07:24.428'
      },
      {
        'field': '@message',
        'value': 'username: simran+test@abc.com ClinicID: 7667 nodename: MacBook-Pro-2.local\n'
      },
      {
        'field': 'username',
        'value': 'simran+test@abc.com'
      },
      {
        'field': 'ClinicID',
        'value': '7667'
      },
      {
        'field': 'nodename',
        'value': 'MacBook-Pro-2.local\n'
      }
    ]
  ]
}

What operating systems does Cloudwatch support?

CloudWatch helps in providing and receiving metrics for all EC2 instances and also can work can work with operating system currently that are suppoeted by the EC2 services.

How long does Cloudwatch Logs store our Data?

We can store ou data for as long as we want, it also helps in storing our log data indefinitely and changing the retention for LogGroup at any time.

How can we parse mixed text and JSON log entries in CloudWatch for Log Metric Filter?

2016-07-24T21:08:07.888Z [INFO] Command completed lessonrecords-create
{
  "key": "lessonrecords-create",
  "correlationId": "c1c07081-3f67-4ab3-a5e2-1b3a16c87961",
  "result": {
    "id": "9457ce88-4e6f-4084-bbea-14fff78ce5b6",
    "status": "NA",
    "private": false,
    "note": "Test note",
    "time": "2016-02-01T01:24:00.000Z",
    "updatedAt": "2016-07-24T21:08:07.879Z",
    "createdAt": "2016-07-24T21:08:07.879Z",
    "authorId": null,
    "lessonId": null,
    "groupId": null
  }
}

What does ingestion time mean in CloudWatch?

'events': [
        {
            'logStreamName': 'string',
            'timestamp': 123,
            'message': 'string',
            'ingestionTime': 123,
            'eventId': 'string'
        },
    ]