Question

我希望有人可以提供帮助，我正在尝试从安装了EC2config服务的Windows Server 2012中传输日志。

我已按照以下文档： https://aws.amazon.com/blogs/devops/using-cloudwatch-logs-with-amazon-ec2-running-microsoft-windows-server/

不幸的是，没有任何内容可以流式传输到云计算日志。

这是我正在使用的Json：

{
"EngineConfiguration": {
    "PollInterval": "00:00:15",
    "Components": [
        {
            "Id": "ApplicationEventLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogName": "Application",
                "Levels": "1"
            }
        },
        {
            "Id": "SystemEventLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogName": "System",
                "Levels": "7"
            }
        },
        {
            "Id": "SecurityEventLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
            "LogName": "Security",
            "Levels": "7"
            }
        },
        {
            "Id": "ETW",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogName": "Microsoft-Windows-WinINet/Analytic",
                "Levels": "7"
            }
        },
        {
            "Id": "IISLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.IISLogOutput,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
        "LogDirectoryPath": "C:\\inetpub\\logs\\LogFiles\\W3SVC1"
        "AccessKey": "",
        "SecretKey": "",
        "Region": "eu-west-1",
        "LogGroup": "Web-Logs",
        "LogStream": "IIStest"
            }
        },
        {
            "Id": "CustomLogs",
            "FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogDirectoryPath": "C:\\CustomLogs\\",
                "TimestampFormat": "MM/dd/yyyy HH:mm:ss",
                "Encoding": "UTF-8",
                "Filter": "",
                "CultureName": "en-US",
                "TimeZoneKind": "Local"
            }
        },
        {
            "Id": "PerformanceCounter",
            "FullName": "AWS.EC2.Windows.CloudWatch.PerformanceCounterComponent.PerformanceCounterInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "CategoryName": "Memory",
                "CounterName": "Available MBytes",
                "InstanceName": "",
                "MetricName": "Memory",
                "Unit": "Megabytes",
                "DimensionName": "",
                "DimensionValue": ""
            }
        },
        {
            "Id": "CloudWatchLogs",
            "FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "AccessKey": "",
                "SecretKey": "",
                "Region": "eu-west-1",
                "LogGroup": "Win2Test",
                "LogStream": "logging-test"
            }
        },
        {
            "Id": "CloudWatch",
            "FullName": "AWS.EC2.Windows.CloudWatch.CloudWatch.CloudWatchOutputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": 
            {
                "AccessKey": "",
                "SecretKey": "",
                "Region": "eu-west-1",
                "NameSpace": "Windows/Default"
            }
        }
    ],
    "Flows": {
        "Flows": 
        [
            "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
    "IISLog"
        ]
    }
} 
}

此时我只想流式传输IIS日志，根据我的理解，Cloudwatch日志组和流应自动创建。

Answer 1

看起来我在JSON文件本身上犯了一些错误，特别是FLOW区域。

现在有了这个工作：）

Answer 2

“流程”部分的问题是缺少流程定义的第二个组成部分：

代替

"Flows": {
    "Flows": 
    [
        "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
"IISLog"
    ]
}

应该是

    [
        "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
        "IISLog,CloudWatchLogs"
    ]

Flows部分定义了Components部分中组件的来源和目标，首先是获取内容/方法，其次是如何发送。例如考虑将此处的以下代码段ApplicationEventLog和SystemEventLog发送到CloudWatch（指的是"Id" : "CloudWatch"中定义的Components，而不是AWS CloudWatch）。

第二行定义了第二个流，即PerformanceCounter发送到CloudWatch1

    "Flows": {
        "Flows": 
        [
            "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
            "PerformanceCounter,CloudWatch1"
        ]
    }

希望这说明了如何解决该问题。

EC2Config Cloudwatch记录流式传输无法正常工作

2 个答案: