Monitoring and Optimization · Topic 1 of 6
CloudWatch Metrics and Alarms
Learn how CloudWatch metrics, the agent, alarms, composite alarms and missing data settings work, and how to build alarms for the SOA-C03 exam.
- 5 min
- A metric is identified by namespace, name and dimensions.
- EC2 basic monitoring is every 5 minutes, detailed monitoring is every 1 minute.
- Memory and disk space need the CloudWatch agent (or custom metrics).
What it is
Amazon CloudWatch is the AWS service that collects numbers about your resources over time. Each number series is called a metric, such as CPU use of one EC2 (Elastic Compute Cloud) instance.
A CloudWatch alarm watches one metric (or a math expression) and changes state when the value crosses a threshold you set. The alarm can then notify people or trigger an action.
How it works
Metric building blocks
A metric lives in a namespace (for example AWS/EC2) and is identified by its name plus dimensions. A dimension is a name and value pair, such as InstanceId. The same metric name with different dimensions is a different metric.
| Item | Meaning |
|---|---|
| Namespace | Container for related metrics, AWS/EC2 or your own |
| Dimension | Pair that picks one resource or group |
| Statistic | Average, Sum, Minimum, Maximum, SampleCount or a percentile |
| Period | Length of each aggregation window in seconds |
| Resolution | Standard (one minute) or high resolution (down to one second, custom metrics only) |
AWS services publish metrics for you. EC2 basic monitoring reports every five minutes, and detailed monitoring reports every minute at extra cost.
What EC2 does not report
EC2 metrics come from the hypervisor, so CloudWatch cannot see inside the operating system. Memory use and disk space used are not published by default.
To get them, install the CloudWatch agent on the instance. The agent needs an IAM (Identity and Access Management) role on the instance, and its settings can be stored in Systems Manager Parameter Store. You can also push your own values with the PutMetricData API call.
Alarms
An alarm has three states: OK, ALARM and INSUFFICIENT_DATA. You choose the metric, statistic, period, threshold and how many periods must breach.
The setting "datapoints to alarm" lets the alarm fire when, for example, 3 of the last 5 periods breach. This avoids alarms on a single spike.
# AWS CLI
aws cloudwatch put-metric-alarm \
--alarm-name HighCPU \
--namespace AWS/EC2 --metric-name CPUUtilization \
--dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
--statistic Average --period 300 --evaluation-periods 3 \
--threshold 80 --comparison-operator GreaterThanThreshold \
--alarm-actions arn:aws:sns:us-east-1:111122223333:ops-alertsMissing data
Metrics sometimes have no data points, for example when an instance is stopped. The alarm setting for missing data decides what happens.
| Setting | Effect |
|---|---|
| notBreaching | Missing points count as inside the threshold |
| breaching | Missing points count as over the threshold |
| ignore | Alarm keeps its current state |
| missing | Alarm moves to INSUFFICIENT_DATA after enough missing periods |
Alarm actions
An alarm can notify an SNS (Simple Notification Service) topic, run an Auto Scaling policy, or perform an EC2 action such as stop, terminate, reboot or recover. It can also create a Systems Manager OpsItem.
Alarm actions run when the state changes. They do not run again every period while the alarm stays in ALARM.
Composite and anomaly alarms
A composite alarm combines other alarms with AND, OR and NOT rules. Use it to cut noise, for example to page only when both the CPU alarm and the error rate alarm are in ALARM.
An anomaly detection alarm compares the metric with an expected band learned from past data, instead of a fixed number. It suits metrics with daily or weekly patterns.
Dashboards and metric math
A dashboard shows many metrics in one view and can span Regions. Metric math lets you compute a new series, such as an error percentage from error count divided by request count.
When a question asks for memory or disk usage on EC2, the answer is the CloudWatch agent, because the default EC2 metrics do not include them.
What to remember for the exam
- A metric is identified by namespace, name and dimensions.
- EC2 basic monitoring is every 5 minutes, detailed monitoring is every 1 minute.
- Memory and disk space need the CloudWatch agent (or custom metrics).
- Alarm states are OK, ALARM and INSUFFICIENT_DATA.
- Use "datapoints to alarm" (M out of N) to avoid flapping on spikes.
- Choose the missing data setting on purpose: notBreaching, breaching, ignore or missing.
- Alarm actions include SNS, Auto Scaling, EC2 stop, terminate, reboot or recover, and Systems Manager OpsItem.
- Composite alarms combine alarms to reduce notification noise.
- Billing metrics are published in the US East (N. Virginia) Region.
Common mistakes
Expecting memory metrics by default. EC2 does not send memory or disk space used unless the agent is installed and configured.
Setting the period shorter than the data arrives. A one-minute period on a five-minute metric leaves gaps and leads to INSUFFICIENT_DATA.
Ignoring missing data. A stopped or crashed instance sends nothing. If missing data is treated as notBreaching, an outage can look healthy.
Reading Average when you need Maximum. Averages hide short peaks, so choose the statistic that matches the question.
Forgetting that alarms are Regional. An alarm lives in the same Region as the metric it watches, so build alarms where the resource lives.
An alarm in INSUFFICIENT_DATA is not the same as healthy. Check why data is missing before you assume things are fine.
Check yourself
Answer these without looking back.
Which tool provides memory and disk space metrics for EC2?
The CloudWatch agent, because default EC2 metrics come from the hypervisor and do not include them.
What does "datapoints to alarm" do?
It requires M breaching periods out of N evaluated periods before the alarm enters ALARM, which avoids reacting to single spikes.
How can you page someone only when two conditions are both true?
Create a composite alarm that combines the two alarms with an AND rule.
Topic 1 of 6 in Monitoring and Optimization
Test yourself on Monitoring and Optimization
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.