CloudWatch · Metrics, Logs and Alarms

Outcome

• MetricsThe Metric Data Model
  • Explain the four-level hierarchy: Namespace → MetricName → Dimensions → Data Points
  • Explain why changing a dimension value creates a new metric series, not an update
  • Choose the correct statistic (Sum vs. Average vs. Maximum) for a given metric type
  • Explain CloudWatch's data retention tiers and why querying old data at 1-minute period returns empty
  • Explain why querying a non-existent metric returns no error
• MetricsPublishing Custom Metrics
  • Publish custom metrics via put-metric-data with correct namespace, dimensions, and unit
  • Publish multiple metrics in a single API call
  • Explain why a dimension key typo creates a ghost metric with no warning
  • Explain the difference between standard-resolution and high-resolution metrics
  • Explain the 2-week backfill limit and what happens when you exceed it
• MetricsMetric Math
  • Use get-metric-data (not get-metric-statistics) for Metric Math expressions
  • Compute error rate as (errors / invocations) * 100 without publishing a separate metric
  • Use FILL(m1, 0) for counters and FILL(m1, REPEAT) for gauges
  • Explain why RATE() is only meaningful on cumulative counters
  • Handle division by zero in Metric Math using IF(denominator > 0, expression, 0)
• MetricsAnomaly Detection
  • Create an anomaly detection model on a custom metric
  • Explain the model warm-up states: PENDING_TRAINING → TRAINED_INSUFFICIENT_DATA → TRAINED
  • Configure exclusion windows to prevent known anomalies from corrupting the model
  • Explain the threshold multiplier tradeoff between sensitivity and false alarm rate
  • Explain why an anomaly alarm before model training stays in INSUFFICIENT_DATA
• LogsLog Groups, Streams, and Retention
  • Explain the three-level hierarchy: Log Group → Log Stream → Log Event
  • Create a log group with an explicit retention policy and explain the cost of omitting one
  • Write log events via CLI using millisecond timestamps
  • Explain why JSON log events enable better querying than plain text
  • Explain why events must be in chronological order within a single put-log-events call
• LogsCloudWatch Logs Insights
  • Run a Logs Insights query via CLI using start-query + get-query-results
  • Use fields, filter, stats, sort, and limit correctly
  • Compute p99 latency per event type using pct(field, 99)
  • Use bin(1m) to bucket events into time windows
  • Use parse to extract fields from plain text logs and explain why order matters
  • Explain why filter before parse returns zero results with no error
  • Explain why fields after stats is invalid
• LogsLog Metric Filters
  • Create a metric filter that counts matching log events
  • Create a metric filter that extracts a numeric field value as the metric value
  • Use filter-log-events to validate a filter pattern before creating it
  • Explain why metric filters are not retroactive and when to use Logs Insights instead
  • Explain why the term filter ERROR produces false positives on JSON logs
  • Explain why a nested field like $.context.code may not match in filter patterns
• LogsCloudWatch Agent on EC2
  • Explain the two IAM policies the Agent needs and what each enables
  • Write a valid Agent config that collects a log file and mem_used_percent / disk_used_percent
  • Verify Agent health using the Agent's own log file on the instance
  • Explain why mem_used_percent is not available in AWS/EC2 without the Agent
  • Explain what to check first when EC2 logs stop arriving in CloudWatch
• AlarmsAlarm Fundamentals & States
  • Explain the three alarm states: OK, ALARM, INSUFFICIENT_DATA
  • Explain why INSUFFICIENT_DATA is not the same as OK and when it occurs
  • Create a metric alarm with correct Period, EvaluationPeriods, and DatapointsToAlarm
  • Explain the difference between treat-missing-data notBreaching and breaching and when to use each
  • Explain why EvaluationPeriods=1 can cause flapping and how DatapointsToAlarm fixes it
  • Observe all three state transitions in a single alarm lifecycle
• AlarmsActions: SNS, Lambda, and Auto-Remediation
  • Create an SNS topic and attach it as an alarm action for ALARM and OK transitions
  • Explain that alarm actions fire on state transitions, not continuously while in ALARM
  • Subscribe a Lambda function to SNS and parse the alarm payload in the handler
  • Explain why a missing Lambda resource policy causes silent action failures
  • Explain why an unconfirmed SNS email subscription delivers nothing with no error
• AlarmsComposite Alarms
  • Explain what a composite alarm is and why it reduces alert noise
  • Create a composite alarm with AND/OR boolean logic over component alarms
  • Explain the AlarmRule syntax: ALARM(), OK(), INSUFFICIENT_DATA(), AND, OR, NOT
  • Explain why a typo in a component alarm name causes permanent INSUFFICIENT_DATA
  • Explain the tradeoff between noise reduction and sensitivity in composite alarm design
• AlarmsMetric Math Alarms & Dashboards
  • Create an alarm on a Metric Math expression using --metrics instead of --metric-name
  • Use IF(denominator > 0, expression, 0) to prevent INSUFFICIENT_DATA from division by zero
  • Alarm on error rate (%) derived from raw error and invocation counts
  • Create a CloudWatch dashboard with alarm status, time-series, and expression widgets
  • Explain why --statistic p99 is invalid and --extended-statistic p99 is required