‫Now let's discuss CloudWatch alarms.
‫So alarms, as we know, they're used to trigger notifications
‫from any metric.
‫And you can define complex alarms on various options
‫such as sampling or doing percentage or max/min and so on.
‫Alarm has three states.
‫OK means that it's not triggered.
‫INSUFFICIENT_DATA means that there's not enough data
‫for the alarm to determine a state.
‫And ALARM, which is that your threshold has been breached
‫and therefore a notification will be sent.
‫The period is how long you want the alarm
‫to evaluate for on the metric.
‫And so it could be very, very short or very, very long
‫and it can apply also to high resolution custom metrics.
‫For example, 10 seconds, 30 seconds,
‫or a multiple of 60 seconds.
‫Now, alarms have three main targets.
‫The first one is actions on EC2 instances,
‫such as stopping it, terminating it, rebooting it,
‫or recovering any instance.
‫The second one is to trigger an auto-scaling action.
‫For example, a scale out or a scale in.
‫And the last one is to send a notification
‫to the SNS service.
‫For example, from the SNS service,
‫we can hook it to a Lambda function
‫and have the Lambda function do pretty much anything we want
‫based on an alarm being breached.
‫So now let's talk about composite alarms.
‫Because we know that CloudWatch alarms
‫are on a single metric,
‫but then if you wanted to have multiple metrics,
‫you would need to use composite alarms
‫because composite alarms are actually measuring
‫the states of multiple other alarms
‫and these alarms can be each relying
‫on one different metric.
‫So the composite alarm is the action of combining
‫all these other alarms together.
‫And you can use AND or OR conditions
‫to be able to be very flexible
‫in terms of the condition you're checking for.
‫So it's very helpful to reduce alarm noise
‫because you can create complex composite alarms and saying,
‫for example, if the CPU is high and the network is high,
‫then don't alert me because I only wanna know
‫when the CPU is high and the network is low,
‫this kind of things.
‫So let's take an example.
‫We have an EC2 instance
‫and we're going to create a composite alarm on top of it.
‫So therefore, we create a first underlying alarm
‫called Alarm-A which is going to monitor the CPU
‫of the EC2 instance.
‫Then you create Alarm-B
‫which is going to monitor the IOPS of the EC2 instance.
‫And then the composite alarm
‫is defined as the junction of Alarm-A and Alarm-B.
‫And therefore, if Alarm-A is in ALARM
‫and Alarm-B is in ALARM,
‫and this is something we have to define ourselves,
‫then the composite alarm itself would be in ALARM
‫and can trigger, for example, an SNS notification.
‫So as you can see,
‫you can get quite creative with the composite alarms.
‫So let's talk about EC2 instance recovery.
‫We've already seen it,
‫but there is a status check to check the EC2 VM
‫and the system status check to check the underlying hardware
‫and you can define a CloudWatch alarm
‫on both of these checks,
‫so you will monitor a specific EC2 instance.
‫And in case the alarm is being breached,
‫then you can start an EC2 instance recovery to make sure,
‫for example, that you move your EC2 instance
‫from one host to another.
‫When you do a recovery,
‫you get the same private, public, and elastic IP,
‫the same metadata,
‫and the same placement group for your instance.
‫And you can also send an alert to your SNS topic
‫to get alerted that the EC2 instance was being recovered.
‫Now, the CloudWatch alarm has some good stuff to know.
‫First of all is that as we've seen, we can create an alarm
‫on top of a CloudWatch Logs metric filter.
‫So remember, the CloudWatch Logs are having a metric filter
‫which is hooked to CloudWatch alarm.
‫And then when we receive
‫too many instances of a specific word,
‫for example, the word error,
‫then do an alert and send a message into Amazon SNS.
‫And so if you wanted to test alarm notifications,
‫you can use a CLI call called set-alarm-state.
‫And this is helpful when you want to trigger an alarm
‫even though it didn't reach a specific threshold
‫because you wanted to see whether or not
‫the alarm being triggered
‫results in the correct action for your infrastructure.
‫So that's it for alarms, I hope you liked it,
‫and I will see you in the next lecture for some practice.