so in this lesson we're just going to take this a little bit further and look 2
at how we can use cloud watch as an administration tool so not only just for 3
invoking ec2 instances in an auto scaling group or whatever we're doing 4
but also to look at how we can use it as one one of our key tool box tools that 5
we can actually monitor and then we can actually use for compliance whether we 6
can use for providing information to management and the like so we'll go 7
through and look at statistics we'll go through further into CloudWatch alarms 8
and also look at cloud watch events so the way cloud watch can trigger 9
something to happen and also we'll look at cloud watch logs like cloud watch can 10
can monitor log information and also act on that log information if required so 11
cloud watch metrics are available across a wide range in the majority of AWS 12
resources but they're not available in all regions on all resources so you 13
really need to have a look at the full list that's online at the developer 14
guide look at the online version because it's it's going to be updated when that 15
when those services are more available for example that they could be billing 16
so we not only look at it for resources but we can also look at it for for 17
billing so if our costs are going out of control then it's a really good thing to 18
be able to be alerted to that so so that's that's something to definitely 19
consider if you are an administrator and you're responsible for a budget for 20
example we can look at dynamodb ec2 EBS elastic beanstalk Opsworks Kinesis 21
Firehose streams and like so a wide range of areas where we can use cloud watch 22
metrics not just in ec2 so not only can we look at and monitor raw data we can 23
actually look at statistics so if we wanted to look at average and Max and 24
images probably what we would mostly look at if we're looking at this for a 25
for monitoring purpose as far as getting information and displaying that 26
information we can also get those those statistics 27
through three methods we can get it through the CLI the API or through the 28
console so through the CLI or the API to the get metric statistics call and we 29
can get a maximum number of data points of up to 50,850 the maximum number 30
of data points returned from a single request is 1440 so you need to be aware 31
of that if you are looking to dump large or you looking to collect large amounts 32
of information and bring it in so you really need to treat this information as 33
what it is it's a stream of information so it's not something that you would 34
just come along and just get a great big dump of that you would normally manager 35
as a stream or as a regular reading of that data in the short term so and again 36
you can do that with the console and you can also create dashboards so you can 37
display multiple graphs of alarms and metrics on on a dashboard screen so so 38
it's very useful so you need to really not only understand alarms occur but the 39
way in which they occur and how they are invoked so again we can have building 40
alarms as well as resource alarm so be aware of that and we'll have a look at 41
how we utilize building alarms in the at the end of this lesson we know that it 42
integrates with SNS and does that quite well we know that there are three states 43
okay alarm and insufficient data so we just need to make sure that we fully 44
understand how an alarm is invoked and and when it is actually invoked in there 45
under what conditions so I've just got this graph here straight out of the 46
developer guide and the reason I've done that is because this is a graph that you 47
will see on your exam no doubt so just want to make sure that it looks and 48
feels the way that you're going to be used to in the exam so looking at this 49
we've got an alarm that is set up with a threshold set to 3 and an evaluation 50
here it is set to three so if a metric is 51
above the alarm threshold for the number of time periods defined by the 52
evaluation period then the alarm is invoked so looking at our graph here 53
after time period one and two we're down at one so we're well below our threshold 54
or three so that blue line there is our threshold of three so when we go to time 55
period three and we can see that all of sudden jumps up to four so that's our 56
first point where it has exceeded the threshold but an alarm is not has not 57
been invoked because it hasn't done it for the evaluation period of three so it 58
hasn't done it three consecutive times so that's the first time and then we 59
look at time period for which it's still above and time period five which is 60
above so at time period five it's occurred after three time periods 61
so now evaluation period of three so at time period number five our action is 62
invoked our alarm will be invoked so then it drops back down and basically 63
our our service can allow another alarm to occur when it's when it's dropped 64
back down from the alarm threshold so we've dropped back down and we've gone 65
down there the time period eight where we're down to one again and then all of 66
a sudden at nine it's jumped right up to five and a half and then drop back down 67
again so that's dropped up there for one only after one time period so because it 68
hasn't done it for three consecutive time period so at the end of three 69
consider time periods it hasn't occurred that alarm won't be invoked so just need 70
to understand how that how that works and understand that graph also 71
understand that it's not always above the threshold it could be below a 72
threshold as well so depending on how how that metric is set up so another 73
thing to consider is cloud watch logs so cloud watch can monitor store and access 74
log files from ec2 instances from AWS cloud 75
trail which which collects logs on our API calls through all of our resources 76
or it could be from a number of other resources that we generate log files so 77
that allows us to have real time monitoring of our log information so no 78
longer is this log just being created and then stored away somewhere for later 79
view cloud watch can monitor that log information as a stream in real time as 80
it's occurring which is a great thing so you can really define certain situations 81
where you want to be not notified in real time of that and to take corrective 82
action or whatever you need to do so those logs will be set up as a log 83
stream and that will be a sequence of a log events from a particular source via 84
an ec2 instance or whatever it is now we can set up our log streams in log groups 85
so those log groups they have that there are groups of streams that have the same 86
retention and monitoring and access control settings so you would define 87
those retention monitoring and access control settings and then you would have 88
your log streams organized into log groups so it's one thing to have these 89
streams Headley's log group log groups and have all this information coming in 90
the cloud which needs to know what to look for it needs to know what is not 91
normal and so metric filters they allow cloud watch they give cloud watch the 92
opportunity to look at that information and to extract what it needs so defines 93
how information is extracted from that log stream and in what situation a data 94
point a data point would be created by cloud watch and then we have our 95
retention settings and so they're just how long our events are kept in cloud 96
watch logs so cloud watch logs and combine again in the next level c-clamp 97
watch events - very very good services that you can 98
use outside of just the usual alarm situations from an easy 99
to instance or whatever that you can use for in particular for compliance and 100
security issues and also for troubleshooting issues you've used if 101
you you know you've got problems and then you can clearly define what you are 102
looking so you can really sort out the bugs in your infrastructure next we have 103
cloud watch events so they occur when a resource changes States for example it 104
could be an ec2 changes from being running to terminated 105
it could be when an auto scaling group launches a new instance so that's an 106
event that occurs when a resource has changed we can also look at integrating 107
this with cloud cloud trail so cloud trail as we know it logs our 108
API calls so it's a very good security compliance and troubleshooting tool that 109
can help us greatly and we combine the cloud watch events can alert us to 110
problems very quickly so for an example we might want to look at situations when 111
someone logs into the console as a root user and so that's something that we 112
don't want to happen and shouldn't be happening so we could actually have 113
cloud trail set up with a cloud watch event 114
attached to to that cloud trail log log stream and it could send off for example 115
an SNS message or something could happen when that situation occurs so again 116
Claire watch need to know an event that it needs to be alerted to and how to 117
route those to the appropriate target for processing so that's where rules 118
come along where we define the rules for cloud watch to generate an event when 119
that situation occurs and so that will route them to one or more targets now a 120
target can be a lambda function it can be an SNS topic it could be an sqs queue 121
it could be a kanesha stream or it could be built-in targets and an example of a 122
built-in target would be to terminate an instance so you know when something with 123
so when someone logs in as root we might 124
have an instance there we want to terminate the instance or whatever we do so that's 125
an example of a built-in target that we that we can use, so now we just move on 126
to some hands-on stuff and we've got the theory out of the way for now so let's 127
move on