1.1 - CloudWatch metrics and alarms
AWS SysOps Administrator objective 1.1 covers implementing metrics and alarms with Amazon CloudWatch. You need to know that CloudWatch collects namespaced metrics with dimensions, that EC2 sends CPU and network by default but memory and disk usage require the unified CloudWatch agent, and that detailed monitoring lowers the interval to one minute. Alarms move between OK, ALARM and INSUFFICIENT_DATA based on evaluation periods and datapoints to alarm, and can treat missing data. An alarm action can notify through SNS, trigger Auto Scaling, or stop, terminate, reboot or recover an EC2 instance; composite alarms combine several alarms to cut noise. A billing alarm watches EstimatedCharges in us-east-1. Expect scenario questions that describe a missing memory metric, a flapping alarm, or an automated response, and ask which CloudWatch feature or configuration fits.
Memory and disk are not default EC2 metrics = install the CloudWatch agent. Auto-fix a failed instance = EC2 recover alarm action. Billing alarm lives in us-east-1.
Practice questions
1. In Amazon CloudWatch, what is the purpose of a namespace?
- A time window used to evaluate whether a CloudWatch alarm should change state
- A container that groups related metrics, such as AWS/EC2 (correct answer)
- A tag applied to EC2 instances for cost allocation and billing reports
- The IAM boundary that controls who can publish metric data to CloudWatch
A namespace is a container that isolates metrics so metrics from different sources are never mixed; AWS services use names like AWS/EC2. It is not an evaluation window (that describes an alarm period) nor an IAM boundary.
2. You want a CloudWatch alarm to watch CPU for one specific EC2 instance, not the whole fleet. What identifies that single instance's metric?
- A dimension (a name/value pair like InstanceId) (correct answer)
- A namespace prefix automatically added to every per-instance metric stream
- The metric unit field, which is set to Count for each running instance
- A resource tag that EC2 copies into the metric definition automatically
A dimension is a name/value pair (InstanceId=i-xxxx) that uniquely identifies a metric within its namespace, so you can alarm on one instance. The unit field only describes the measure; tags are not automatically copied into metrics.
3. By default EC2 sends metrics to CloudWatch every 5 minutes. What does enabling detailed monitoring change?
- It delivers EC2 metrics at 1-minute intervals (correct answer)
- It adds memory and disk metrics automatically without any agent installation
- It stores the metrics for a longer retention period of two years
- It reduces the per-metric cost by batching data points together
Detailed monitoring lowers the EC2 metric interval from 5 minutes (basic) to 1 minute; it does not add memory or disk metrics, which still require the CloudWatch agent, and it does not change retention.
4. In CloudWatch Logs, how do log streams relate to a log group?
- A log stream contains many log groups from different accounts
- A log group is a collection of log streams that share settings (correct answer)
- Log streams and log groups are two names for the exact same object
- A log group can only ever hold one single log stream at a time
A log group holds many log streams (usually one stream per source like an instance) and applies shared settings such as retention and encryption. A stream does not contain groups, they are not the same object, and a group holds many streams.
5. A new log group was created without touching retention. How long are events kept?
- 30 days by default, then events are deleted automatically
- 90 days, matching the CloudWatch metrics retention window
- Forever, because the default retention is never expire (correct answer)
- One year, after which the whole log group is deleted for you
By default log groups keep events forever (never expire), which quietly grows storage cost until you set a retention policy. The fixed 30/90/365 day options are not defaults and CloudWatch never deletes the whole group automatically.
6. You want the count of the word ERROR in an application log to become a graphable CloudWatch metric. What do you configure?
- A subscription filter that streams the raw log lines to Kinesis
- A CloudWatch Logs Insights saved query scheduled to run hourly
- A metric filter on the log group with a pattern and metric value (correct answer)
- A CloudWatch alarm pointed directly at the text inside the log group
A metric filter scans incoming log events for a pattern and emits a CloudWatch metric you can graph and alarm on. Subscription filters stream data elsewhere, Insights runs ad-hoc queries, and alarms watch metrics, not raw text.