# Send Local Logs to CloudWatch

**Scenario:** You want to save gateway/relay logs to Amazon CloudWatch. This guide presents a simple method to send all gateway/relay logs to a CloudWatch log group.

{% hint style="info" %}
As with all gateway/relay logs, the logs stored on the gateway/relay will not include Admin UI activities, which can be accessed via the `sdm audit activities` command.
{% endhint %}

### Set up the Export

1. Enable relay logging in the Admin UI under **Settings** > **Security** within the **Log Encryption & Storage** tab. Ensure logging is set to **FILE**.
2. Generate an **AWS access key** and **AWS secret access key** from the AWS GUI. Ensure the key has the **AWSAppSyncPushToCloudWatchLogs** permission.
3. Install the Amazon CloudWatch logs agent on the gateway/relay following the [Amazon Cloudwatch logs documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html) directions. If you already have this agent running, skip to the next step for the lines to add to your `/var/awslogs/etc/awslogs.conf` file.
4. For the path, enter `/home/<user>/.sdm/sdm.log*`
5. For the destination log group name, call it `SDM-logs` or similar. If you have multiple gateways, ensure they all use the same log group name.
6. Under the timestamp format, use the following custom string: `%Y-%m-%dT%H:%M:%SZ`
7. For initial upload position, choose **From start of file**.
8. In `/var/awslogs/etc/awslogs.conf`, verify that you have a section that looks like this:

   ```shell
   [/home/ubuntu/.sdm/sdm.log*]
   datetime_format = %Y-%m-%dT%H:%M:%SZ
   file = /home/ubuntu/.sdm/sdm.log*
   buffer_duration = 5000
   log_stream_name = {instance_id}
   initial_position = start_of_file
   log_group_name = SDM-gateway
   ```
9. Check `/var/log/awslogs.log` to ensure there are no errors.
10. Go to the CloudWatch console and verify that there is a log group by the name you specified above.
11. Look at logs to ensure timestamps are correct and logs are being delivered correctly.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.strongdm.com/admin/audit/logs/scenarios/export-to-cloudwatch.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.