AWSMonitoring
Amazon CloudWatch
Monitoring and observability — collect metrics, logs, and traces from AWS resources and applications with alarms, dashboards, and automated actions.
Overview
Amazon CloudWatch is the central monitoring and observability service for AWS — it collects metrics, logs, and events from AWS resources and applications, provides dashboards for visualisation, and triggers alarms and automated actions based on thresholds or anomalies.
Core Concepts
| Concept | Description |
|---|---|
| Metric | A time-ordered series of data points (e.g., CPUUtilization, NetworkIn) |
| Namespace | Container for metrics belonging to a service (e.g., AWS/EC2, AWS/RDS) |
| Dimension | Name-value pair that identifies a metric (e.g., InstanceId=i-1234) |
| Statistic | Aggregation applied over a period: Average, Sum, Min, Max, SampleCount, pNN |
| Period | Length of time for each data point (default 60 s for basic; 1 s for detailed) |
| Alarm | Watches a metric and triggers an action when a threshold is breached |
| Composite Alarm | Combines multiple alarms with AND/OR logic to reduce alarm noise |
| Log Group | Collection of log streams that share retention, access, and monitoring settings |
| Log Stream | Sequence of log events from a single source (e.g., one EC2 instance) |
| Custom Metric | Application-defined metric published via PutMetricData API or CloudWatch Agent |
| Metric Filter | Extracts metric values from log data using pattern matching |
CloudWatch Metrics
Default vs Detailed Monitoring
| Monitoring Level | Resolution | Cost | Examples |
|---|---|---|---|
| Basic | 5-minute | Free | EC2 CPU, Network, Disk (host-level) |
| Detailed | 1-minute | Charged | Enabled per service (EC2: $2.10/instance/month) |
| High-Resolution | 1-second | Charged | Custom metrics with StorageResolution=1 |
Key Default Metrics by Service
| Service | Included Metrics | NOT Included (need agent) |
|---|---|---|
| EC2 | CPUUtilization, NetworkIn/Out, DiskReadOps, StatusCheckFailed | Memory, Disk space, Process count |
| RDS | CPUUtilization, DatabaseConnections, FreeableMemory, IOPS | OS-level metrics (enhanced) |
| ELB | RequestCount, TargetResponseTime, HealthyHostCount | N/A |
| Lambda | Invocations, Duration, Errors, Throttles, ConcurrentExecutions | N/A |
Exam Trap: EC2 does NOT report memory utilization or disk space as default metrics. The CloudWatch Agent must be installed to collect these.
CloudWatch Agent
EC2 Instance / On-Premises Server
└── CloudWatch Agent (installed)
├── Collects: Memory %, Disk %, Swap, Netstat, Processes
├── Collects: Application logs → Log Groups
└── Publishes: Custom metrics → CloudWatch Metrics- Installed via SSM Run Command or manually
- Configured with a JSON configuration file (stored in SSM Parameter Store)
- Supports both EC2 instances and on-premises servers
- Unified CloudWatch Agent replaces older CloudWatch Logs Agent and custom scripts
CloudWatch Alarms
| Alarm State | Meaning |
|---|---|
| OK | Metric is within the defined threshold |
| ALARM | Metric has breached the threshold |
| INSUFFICIENT_DATA | Not enough data to determine state |
Alarm Actions
| Action Target | Description |
|---|---|
| SNS Notification | Send alert to email, SMS, Lambda, or SQS |
| Auto Scaling | Scale out/in a group based on metric threshold |
| EC2 Action | Stop, terminate, reboot, or recover an instance |
| Systems Manager | Run an SSM automation document |
Alarm Evaluation
- Period: How long each data point covers (e.g., 300 s)
- Evaluation Periods: How many consecutive periods must breach the threshold
- Datapoints to Alarm: Minimum breaching points within the evaluation window (M of N)
CloudWatch Logs
Application → CloudWatch Agent → Log Group → Log Stream
│
├── Metric Filter → Custom Metric → Alarm
├── Subscription Filter → Lambda / Kinesis / OpenSearch
├── Export to S3 (async, batch)
└── Logs Insights (ad-hoc queries)Key Features
| Feature | Description |
|---|---|
| Retention | Configurable: 1 day to 10 years, or never expire |
| Metric Filter | Pattern-based extraction of numeric values from log lines |
| Subscription Filter | Real-time stream of log data to Lambda, Kinesis, or OpenSearch |
| Logs Insights | Interactive query language for ad-hoc log analysis |
| Cross-account | Send logs to a central account via subscription filters |
| Export to S3 | Async batch export for long-term archival (not real-time) |
| Live Tail | Real-time streaming view of incoming log events in console |
CloudWatch Logs Insights
Query language for analysing log data:
fields @timestamp, @message
| filter @message like /ERROR/
| stats count(*) as errorCount by bin(5m)
| sort errorCount desc
| limit 20- Supports filtering, aggregation, sorting, and visualisation
- Queries multiple log groups simultaneously
- Results can be exported or added to dashboards
CloudWatch Dashboards
- Custom visualisations with graphs, metrics, alarms, and text widgets
- Cross-account and cross-region widgets supported
- Automatic dashboards for common services (EC2, Lambda, etc.)
Common Use Cases
- Infrastructure monitoring — Track CPU, memory, disk, and network metrics for EC2, RDS, and ECS with threshold alarms.
- Application log analysis — Centralise application logs and use Logs Insights for debugging and trend analysis.
- Auto-scaling trigger — CloudWatch alarm on CPU or custom metric triggers Auto Scaling policy to add/remove instances.
- Anomaly detection — Machine learning-based anomaly detection on metrics to alert on unusual patterns.
- Cross-account observability — Aggregate metrics and logs from multiple accounts into a central monitoring account.
SAA/SAP Exam Tips
SAA Tip: "Monitor memory utilization on EC2" → Install CloudWatch Agent. Default EC2 metrics do NOT include memory or disk space.
SAA Tip: "Real-time log processing" → CloudWatch Logs Subscription Filter to Lambda or Kinesis. S3 export is async/batch — not real-time.
SAP Tip: Composite alarms reduce alarm noise by combining multiple alarms with AND/OR logic — avoiding alert fatigue when multiple related metrics fire simultaneously.
Cross-Cloud Equivalents
| Provider | Service / Solution | Notes |
|---|---|---|
| AWS | Amazon CloudWatch | Baseline |
| Azure | Azure Monitor + Log Analytics | Azure Monitor ≈ metrics; Log Analytics ≈ Logs |
| GCP | Google Cloud Monitoring + Cloud Logging | Separate metrics and logging services |
| On-Premises | Prometheus + Grafana, Datadog, Splunk, ELK Stack | Self-managed or SaaS observability |
Pricing Model
| Dimension | Unit | Notes |
|---|---|---|
| Custom metrics | Per metric/month | First 10 free; $0.30/metric after |
| Detailed monitoring | Per instance/month | $2.10/instance for 1-minute resolution |
| Dashboards | Per dashboard/month | First 3 free; $3/dashboard after |
| Alarms | Per alarm/month | Standard $0.10; high-resolution $0.30 |
| Logs ingestion | Per GB ingested | + storage per GB/month after retention period |
| Logs Insights queries | Per GB scanned | Charged per query based on data scanned |
| API requests | Per 1,000 requests | GetMetricData, PutMetricData, etc. |
Related Services / See Also
- AWS X-Ray — distributed tracing for application performance analysis
- AWS Config — configuration compliance (different from performance monitoring)
- Amazon EC2 — primary source of infrastructure metrics
- Auto Scaling — CloudWatch alarms drive scaling policies
AWS Distro for OpenTelemetry
AWS-supported distribution of OpenTelemetry — instrument once, send correlated traces, metrics, and logs to multiple observability backends.
AWS Config
Configuration compliance — continuously record, assess, and audit AWS resource configurations against desired rules and conformance packs.
Built by Fred Cheung @CookedRicer · Powered by Fumadocs & Github Copilot