CloudWatch Agent Performance Tuning
A DevOps team is using Amazon CloudWatch Logs to collect application logs from multiple EC2 instances. They notice that some log entries are missing and that the CloudWatch agent is consuming high CPU. The log group has a retention policy of 30 days. Which action should the team take to reduce CPU usage without losing log data?
Quick Answer
The answer is to increase the batch size in the CloudWatch agent configuration. This reduces CPU usage by batching more log events into each HTTP API call, which lowers the frequency of network I/O and serialization overhead that drives high CPU consumption. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of the agent’s trade-off between latency and resource efficiency—a common trap is to mistakenly adjust the retention policy or throttle the agent, but those either risk data loss or don’t address the root cause. The key insight is that larger batches mean fewer requests, directly cutting CPU load while preserving every log entry. Remember the mnemonic: “Bigger batches, better CPU—no data lost, just fewer trips to the host.”
⚠ Common exam trap
Watch out — candidates often confuse log retention policies with operational performance tuning, incorrectly assuming that reducing retention frees resources, when in fact it only deletes historical data and has no impact on agent CPU usage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the batch size in the CloudWatch agent configuration.
Increasing the batch size in the CloudWatch agent configuration reduces the number of HTTP API calls made to CloudWatch Logs, which lowers CPU overhead from frequent network I/O and serialization. The agent buffers log events and sends them in larger, less frequent batches, directly addressing high CPU consumption without discarding any log data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Increase the batch size in the CloudWatch agent configuration.
Why this is correct
Correct: Larger batch size reduces API calls and CPU usage.
- ✗
Use JSON format for logs instead of plain text.
Why it's wrong here
Incorrect: Format does not significantly affect CPU.
- ✗
Set the agent's timezone to UTC.
Why it's wrong here
Incorrect: Timezone setting does not affect CPU.
- ✗
Change the log group retention policy to 7 days.
Why it's wrong here
Incorrect: Retention does not affect agent CPU usage.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon CloudWatch Logs to monitor application logs from EC2 instances. The DevOps engineer notices that some log entries are missing. The CloudWatch agent is installed and configured. What is the most likely cause of the missing log entries?
medium- ✓ A.The CloudWatch agent's rate limit is set too low, causing log entries to be dropped.
- B.The CloudWatch agent is compressing logs before sending, causing some entries to be lost.
- C.The log group retention policy is set to 1 day, and logs older than that are automatically deleted.
- D.The log group's maximum size limit has been exceeded.
Why A: The CloudWatch agent has a configurable rate limit that controls how many log events can be sent per second. If the agent cannot keep up with the log generation rate, it may drop entries, resulting in missing log entries. Option A is correct because the rate limit can be set too low. Option B is incorrect because compression does not cause log loss; the agent compresses logs before sending, but that does not drop entries. Option C is incorrect because log retention policies only delete logs after they are stored, not during ingestion. Option D is incorrect because there is no maximum size limit on log events in CloudWatch Logs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.