Quick Start: Install and configure the CloudWatch Logs agent on a running EC2 Linux instance

To configure your IAM role or user for CloudWatch Logs

1. Open the IAM console at https://eusc-de-east-1.console.amazonaws-eusc.eu/iam/.

2. In the navigation pane, choose Roles.

3. Choose the role by selecting the role name (do not select the check box next to the name).

4. Choose Attach Policies, Create Policy.

   A new browser tab or window opens.

5. Choose the JSON tab and type the following JSON policy document.

   {
     "Version":"2012-10-17",		 	 	 
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
           "logs:PutLogEvents",
           "logs:DescribeLogStreams"
       ],
         "Resource": [
           "*"
       ]
     }
    ]
   }
   

6. When you are finished, choose Review policy. The Policy Validator reports any syntax errors.

7. On the Review Policy page, type a Name and a Description (optional) for the policy that you are creating. Review the policy Summary to see the permissions that are granted by your policy. Then choose Create policy to save your work.

8. Close the browser tab or window, and return to the Add permissions page for your role. Choose Refresh, and then choose the new policy to attach it to your role.

9. Choose Attach Policy.

To install and configure CloudWatch Logs on an existing Amazon Linux instance

Starting with Amazon Linux AMI 2014.09, the CloudWatch Logs agent is available as an RPM installation with the awslogs package. Earlier versions of Amazon Linux can access the awslogs package by updating their instance with the sudo yum update -y command. By installing the awslogs package as an RPM instead of the using the CloudWatch Logs installer, your instance receives regular package updates and patches from AWS without having to manually reinstall the CloudWatch Logs agent.

1. Connect to your Amazon Linux instance. For more information, see Connect to Your Instance in the Amazon EC2 User Guide.

   For more information about connection issues, see Troubleshooting Connecting to Your Instance in the Amazon EC2 User Guide.

2. Update your Amazon Linux instance to pick up the latest changes in the package repositories.

   sudo yum update -y

3. Install the awslogs package. This is the recommended method for installing awslogs on Amazon Linux instances.

   sudo yum install -y awslogs

4. Edit the /etc/awslogs/awslogs.conf file to configure the logs to track. For more information about editing this file, see CloudWatch Logs agent reference.

5. By default, the /etc/awslogs/awscli.conf points to the us-east-1 Region. To push your logs to a different Region, edit the awscli.conf file and specify that Region.

6. Start the awslogs service.

   sudo service awslogs start

   If you are running Amazon Linux 2, start the awslogs service with the following command.

   sudo systemctl start awslogsd

7. (Optional) Check the /var/log/awslogs.log file for errors logged when starting the service.

8. (Optional) Run the following command to start the awslogs service at each system boot.

   sudo chkconfig awslogs on

   If you are running Amazon Linux 2, use the following command to start the service at each system boot.

   sudo systemctl enable awslogsd.service

9. You should see the newly created log group and log stream in the CloudWatch console after the agent has been running for a few moments.

   For more information, see View log data sent to CloudWatch Logs.