JUSTIN SAMUEL

What is CloudWatch?

An introduction to CloudWatch.

CloudWatch Agent:

  • CloudWatch uses an agent called the Unified CloudWatch Agent that is installed on an EC2 instance or on-prem server.
  • Collects system-level metrics such as RAM, processes, used disk space, etc.
  • Collects logs, which are sent to CloudWatch Logs.
  • Can be centrally managed using SSM Parameter Store.
  • procstat plugin collects metrics and monitors system utilisation of individual processes.
    • Amount of time process uses CPU (procstat_cpu_usage)
    • Amount of memory process used (procstat_memory_rss)

CloudWatch Logs:

  • Logs are encrypted by default. KMS-based encryption is also available using your own keys.
  • You must first define:
    • Log groups (arbitrary name, typically for an application of interest)
    • Log stream (refers to log files or instances of logs)
  • You can configure log expiration policies (never expire, 1 day -> 10 years, etc.)
  • You can send these logs to the likes of:
    • Amazon S3
    • Kinesis (Data Streams, Firehose)
    • Lambda
    • OpenSearch
  • Sources of logs can come from:
    • SDK
    • CloudWatch Unified Agent
    • Elastic Beanstalk
    • Lambda
    • ECS
    • VPC Flow Logs
    • API Gateway
    • CloudTrail
    • Route 53
  • CloudWatch Logs Insights can be used to search for and analyse log data (not real-time, only historical).
  • CloudWatch Logs Subscriptions can be used to retrieve real-time log events.
    • Logs can be sent to Kinesis, S3, Lambda.
    • Cross-Account Subscription can also be used to sent log events to resources in different AWS accounts.

CloudWatch Alarms:

  • Alarms trigger notifications for any metric.
  • Metrics include:
    • %
    • Max
    • Min
    • …and more
  • Alarm states include:
    • OK
    • INSUFFICIENT_DATA
    • ALARM
  • Period:
    • Length of time (sec) to evaluate metric
    • Custom metrics (every 10 sec, 30 sec, 60 sec, etc.)
  • Composite alarms can be used to monitor the state of multiple alarms using AND and OR conditions.

CloudWatch Contributor Insights:

  • Analyses logs to create a time series showing contributor data and top hitters.
  • For example: identify heaviest network users, find URLs generating most errors.

More reading:

Leave a comment