AWS CloudWatch, X-Ray and CloudTrail Flashcards
Whats the usage of AWS CloudWatch?
- Metrics: Collect and track key metrics
- Logs: Collect, monitor, analyze and store log files
- Events: Send notifications when certain events happen in your AWS
- Alarms: React in real-time to metrics / events
Whats the usage of AWS X-Ray?
- Troubleshooting application performance and errors
- Distributed tracing of microservices
Whats the usage of AWS CloudTrail?
- Internal monitoring of API calls being made
- Audit changes to AWS Resources by your users
Whats a CW Metric?
- Metric is a variable to monitor (CPUUtilization, NetworkIn…)
- Metrics belong to namespaces
- Dimension is an attribute of a metric (instance id, environment, etc…).
- Up to 30 dimensions per metric
- Metrics have timestamps
What is EC2 Detailed monitoring?
- EC2 instance metrics have metrics “every 5 minutes”
- With detailed monitoring (for a cost), you get data “every 1 minute”
- Use detailed monitoring if you want to scale faster for your ASG!
Does EC2 Memory usage pushed by default to CW?
Nope
Whats CW Custom Metrics?
Possibility to define and send your own custom metrics to CloudWatch.
* Use API call PutMetricData
* Ability to use dimensions (attributes) to segment metrics
* Metric resolution (StorageResolution API parameter – two possible value):
– Standard: 1 minute (60 seconds)
– High Resolution: 1/5/10/30 second(s) – Higher cost
Whats the time range where you can push CW Custom metrics?
Custom metrics can be pushed two weeks in the past and two hours in the future.
What are CW Logs?
- Log groups: arbitrary name, usually representing an application
- Log stream: instances within application / log files / containers
- Can define log expiration policies (never expire, 30 days, etc.
Where can you send CW Logs?
- Amazon S3 (exports)
- Kinesis Data Streams
- Kinesis Data Firehose
- AWS Lambda
- OpenSearch
What are the sources of the CW Logs?
- SDK, CW Logs Agent, CW Unified Agent
- Elastic Beanstalk: collection of logs from applications
- ECS: collection from containers
- AWS Lambda: collection from function logs
- VPC Flow Logs: VPC specific logs
- API Gateway
- CloudTrail based on filter
- Route53: Log DNS queries
What is CW Metric Filter and Insights?
- CloudWatch Logs can use filter expressions
- Metric filters can be used to trigger CloudWatch alarms
- CloudWatch Logs Insights can be used to query logs and add queries to CloudWatch Dashboards
What is CW Metric Filter and Insights?
- CloudWatch Logs can use filter expressions
- Metric filters can be used to trigger CloudWatch alarms
- CloudWatch Logs Insights can be used to query logs and add queries to CloudWatch Dashboards
How much time does it take to export CW Logs to S3?
It can take up to 12 hours.
What is the API call to export CW logs to s3?
CreateExportTask
What is CW Logs Subscription?
You can register real time handlers. It can send to:
* Lambda
* Kinesis Data Firehose
* Kinesis Data Stream
How to aggregate Multi-Account / Multi Region logs?
With subscription filters directiong to one Kinesis Data Stream.
Are CW logs sent by EC2 instances?
No, you need to run CW agent to push the log files. Make sure to use the correct IAM permissions
What is CW Logs Agent?
Old agent version, can only push logs to CW Logs
What is CW Unified Agent?
The newer agent version:
* Collect additional system-level metrics
* Collect logs to send to CW Logs
* Centralized confi using SSM Parameter Store
What are the CW Unified Agent metrics?
- CPU (active, guest, idle, system, user, steal)
- Disk metrics (free, used, total), Disk IO (writes, reads, bytes, iops)
- RAM (free, inactive, used, total, cached)
- Netstat (number of TCP and UDP connections, net packets, bytes)
- Processes (total, dead, bloqued, idle, running, sleep)
- Swap Space (free, used, used %)
What CW Logs Metric Filter?
- Filter CW Logs by expression
- Filters do not retroactively filter data. Its publish the metric data after it was created
What is CW Alarm?
- Alarms are used to trigger notifications for any metric
- Various options (sampling, %, max, min, etc…)
What are the CW Alarm states?
- OK
- INSUFFICIENT_DATA
- ALARM
What can be the target of CW Alarm?
- Amazon EC2
- EC2 Auto Scaling
- Amazon SNS
Stop, Terminate or Recover EC2 instance.
Trigger auto scaling action
Send noti to SNS
What are CW Compiste Alarms?
- Composite Alarms are monitoring the states of multiple other alarms
- AND and OR conditions
- Helpful to reduce “alarm noise” by creating complex composite alarms
How to test CW Alarms and Notifications by CLI?
aws cloudwatch set-alarm-state –alarm-name “myalarm” –state-value
ALARM –state-reason “testing purposes”
