Skip to Content

CloudWatch: Metrics, Logs, Alarms

When to use

Observe the health of your AWS resources and applications; alert when something goes wrong.

Analogy

CloudWatch is the cockpit instrument panel. Metrics are dials; logs are the black-box voice recorder; alarms are the warning light.

Data-flow diagram

  AWS Service (EC2, RDS, Lambda)
        | emit metric, log
        v
  CloudWatch Metrics (time-series)   CloudWatch Logs (text)
        |                                     |
        v                                     v
  CloudWatch Alarm: error_rate > 1% for 5 min  --> SNS Topic
                                                                v
                                                  PagerDuty / SMS / Auto-remediation

Deep explanation

Metrics are time-series data points emitted by every AWS service. Logs are structured text from agents or services. Alarms are thresholds on metrics that trigger SNS Topics for notifications, Auto Scaling, or Systems Manager automation. CloudWatch Logs Insights runs SQL-like queries across log groups. X-Ray adds distributed tracing. Logs can be exported to S3 for long-term archival.

Examples

Example 1

aws cloudwatch put-metric-alarm --alarm-name high-cpu \
  --metric-name CPUUtilization --namespace AWS/EC2 \
  --statistic Average --period 300 --threshold 80 \
  --comparison-operator GreaterThanThreshold --evaluation-periods 2 \
  --alarm-actions arn:aws:sns:us-east-1:...:ops-alerts

alarm: if average CPU > 80% for two consecutive 5min periods, fire SNS.

Example 2

aws logs create-log-group --log-group-name /aws/lambda/myfn
aws logs tail /aws/lambda/myfn --follow

creates log group and tails; tailing shows live Lambda stdout/stderr.

Example 3

aws logs start-live-tail --log-group-identifiers /aws/lambda/myfn

CloudWatch Logs Insights-style live tail (newer); debug hot issues.

Common mistake

Alarms on averages (a 30s spike blended with 4.5min idle is invisible - use Maximum or p99). Alarm fatigue (40 alarms firing regardless). Missing logs from kustomized containers (default agent may not be installed).

Key takeaway

alert on MAX/p95/p99 rather than average; tier alarms (P1 page, P2 ticket, P3 dashboard); central log group naming; Logs Insights queries for incident forensics.

Production Failure Playbook

Failure scenario 1: no-alarm-slow-degradation

Failure scenario 2: log-cost-explosion