An EC2 application's text logs are continuously ingested into the CloudWatch Logs Standard class. Failed authentication lines contain AuthenticationFailed.
Monitor newly ingested logs after setup and notify when failures exceed 10 in one minute. An SNS topic and subscription are ready.
Which configuration provides automated count monitoring?
Publish 1 per filter match and notify SNS when the one-minute Sum exceeds 10.
Detailed explanation
Sum adds the matching events in the period; configure SNS as the alarm action.
Sum adds the matching events in the period; configure SNS as the alarm action.
Management events audit AWS API operations, not these application log entries.
Management events audit AWS API operations, not these application log entries.
This investigates stored logs but does not provide continuous notification by itself.
This investigates stored logs but does not provide continuous notification by itself.
The average of values of 1 is not an event count, even with many failures.
The average of values of 1 is not an event count, even with many failures.
Check official documentation
Compare the following points with the official documentation.
Read Monitoring log data and check match value, Sum, and when filtering starts.
Official references
What to confirm
Eleven matches produce Sum=11. Existing historical logs are not backfilled by a newly configured filter.
Key points
- Metric filter
- AuthenticationFailed
- Custom metric
Notes
- Environment: AWS SOA-C03 exam guide and the linked AWS documentation
- Reviewed against the linked AWS documentation on 2026-10-03.
Foundation review
Count using Sum
With value 1 per match, Sum counts events; Average does not. Set the period, threshold, and SNS alarm action.
Historical data and missing values
Filters require Standard class and are not retroactive. With no dimensions, default 0 covers ingested logs without matches; no ingested logs produces no value. Decide how the alarm treats missing data.