Creating CloudWatch custom metrics and metric filters, alarms, and notifications (for example, Amazon SNS, Lambda)

Can you describe what a CloudWatch custom metric is and why you might need to create one?

A CloudWatch custom metric is a user-defined metric that enables you to monitor data points or events that AWS CloudWatch does not automatically track. You might need to create one to monitor application-specific events, system performance, or any other business-related KPIs that are not covered by the default AWS metrics.

How would you go about publishing a custom metric to CloudWatch?

To publish a custom metric to CloudWatch, you use the put-metric-data API action either through the AWS CLI, an AWS SDK, or the CloudWatch API. You need to specify a namespace, a metric name, and at least one data point (with a value and a timestamp).

What are metric filters in CloudWatch, and how do you use them?

Metric filters in CloudWatch are used to turn log data into numerical CloudWatch metrics that you can graph or set alarms on. You set up metric filters by providing search patterns within log data, and each time the pattern is found, it can increment a metric that you define.

Could you explain the process of setting up an alarm based on a custom metric in CloudWatch?

To set up an alarm based on a custom metric in CloudWatch, you navigate to the CloudWatch dashboard, select ‘Alarms’, click on ‘Create Alarm’, choose the custom metric, and define the conditions that will trigger the alarm. You can then configure actions, such as sending notifications through Amazon SNS or initiating an Auto Scaling policy.

How can CloudWatch alarms integrate with AWS Lambda, and provide an example of when this might be appropriate?

CloudWatch alarms can trigger a Lambda function when a certain threshold is breached. For example, if you have a custom metric that counts error messages in logs, you can set up an alarm to invoke a Lambda function to automatically investigate or apply a fix when the error count exceeds a certain number.

In the context of CloudWatch and SNS, what is the significance of topics and subscriptions?

In the context of CloudWatch and SNS (Simple Notification Service), a “topic” acts as a communication channel, while “subscriptions” are endpoints like emails, SMS, HTTP/S endpoints, or Lambda functions that receive messages published to the topic. When an alarm state changes, it can publish a message to an SNS topic, which will then notify all subscribed endpoints.

What are some considerations for ensuring the high-resolution granularity of custom CloudWatch metrics?

For high-resolution granularity of custom CloudWatch metrics, you should consider publishing metrics with a period of less than 60 seconds, known as high-resolution metrics. This allows for more precise and rapid scaling policies and more detailed monitoring. Note that high-resolution metrics may incur additional costs.

What are the best practices for creating meaningful alarm names and descriptions in CloudWatch?

Best practices for creating meaningful alarm names and descriptions in CloudWatch include using descriptive and consistent naming conventions that reflect the metric, condition, and the resource being monitored. Descriptions should clearly state the significance of the alarm and what action is expected when it is triggered.

How would you troubleshoot a situation where CloudWatch custom metrics are not showing up in the dashboard?

To troubleshoot this issue, you would verify that the correct IAM permissions are in place, ensure the metric data is within the retention period, check for correct namespace and dimension names, confirm that the data points are within the supported range, and inspect any relevant logs for errors during the data publish action.

What is the difference between period and evaluation period on a CloudWatch alarm?

The period is the length of time associated with a specific metric data point that CloudWatch is analyzing. Evaluation period is the number of recent data points CloudWatch uses to evaluate the alarm condition. For example, an alarm set to a 1-minute period with an evaluation period of 3 will analyze three consecutive one-minute data points to decide the alarm state.

How can you configure a CloudWatch alarm to recover an EC2 instance when it becomes impaired?

You can configure a CloudWatch alarm to automatically recover an EC2 instance by selecting the “EC2 Action – Recover this instance” option when setting up the alarm action. This works only for certain types of instance impairments and not for underlying hardware failures.

Can you explain how CloudWatch Logs Insights can be used in conjunction with metric filters and alarms?

CloudWatch Logs Insights allows you to run queries against log data. You can use this feature to troubleshoot metric filter patterns by running queries that use the same patterns. Once you’ve verified the correct patterns, you can create metric filters based on the results. These filters can then be used to trigger alarms by incrementing metrics whenever logs match the defined patterns.