Monitoring
The monitoring stack
CloudMonitor is the central service for metrics, events, and alerts across Alibaba Cloud resources. It collects built-in metrics for services like ECS, RDS, SLB, and OSS, and supports custom metrics pushed from applications. Alarms are defined by a metric, a comparison, a threshold, a period, and an evaluation count, then routed to notification contacts or groups. ActionTrailer records API-level audit events (who did what, when), which is distinct from performance monitoring-a frequent trap.
Logs and traces
Log Service (SLS) ingests, indexes, and queries logs; it supports alerts on log queries, which complements metric alarms. Application Real-Time Monitoring Service (ARMS) covers application performance and tracing. Together the pattern is: metrics for health, logs for diagnosis, traces for latency.
Designing alarms
Good alarm design avoids two failure modes: too noisy (alerts that fire constantly) and too quiet (thresholds that never trigger). Use evaluation counts to require sustained breaches, and separate warning from critical severities. For availability, monitor from outside the resource (synthetic or health checks) rather than only host-level metrics. For capacity, trend metrics like disk usage rather than single samples.
Traps to watch
- CloudMonitor vs. ActionTrail: performance vs. audit. A question about "who deleted the instance" is ActionTrail.
- Agent dependency: some host-level metrics (memory, process) require the CloudMonitor agent; basic metrics may not include them.
- Alarm state vs. event: an alarm transitions through states (OK, alert); notifications depend on contact groups being configured.
- Metric period and aggregation: a short period with a high evaluation count can delay firing; understand the trade-off.
Rule of thumb
Match the question to the signal: "is it slow or down?" → metrics; "why did it fail?" → logs; "who changed it?" → ActionTrail; "where is latency spent?" → traces.
Worked example
You want an alert when an ECS instance's CPU stays above 80% for five minutes. Set a CloudMonitor alarm on the CPU metric with an 80% threshold, a 60-second period, and an evaluation count of 5, routed to an on-call contact group. Requiring five consecutive breaches prevents single-spike noise.
Security and Cost Operations
Identity and access
RAM is the center of Alibaba Cloud security operations. Design with least privilege: policies attach to users, groups, or roles and define allowed actions on resources. Prefer roles over long-term access keys for workloads (ECS instance roles, cross-account roles). Enable multi-factor authentication for privileged users and rotate credentials. A common trap is confusing a RAM policy (what an identity can do) with a security group (what network traffic can reach a resource)-they solve different problems.
Data protection and compliance
Use Key Management Service (KMS) for encryption keys, enable encryption at rest on disks and OSS buckets, and use TLS in transit. Security Center provides threat detection and baseline checks. ActionTrail plus Log Service supports audit retention. Resource tagging underpins both security grouping and cost allocation.
Cost operations
Billing models matter: subscription (prepaid, cheaper for steady workloads), pay-as-you-go (flexible, higher unit cost), and spot/preemptible instances (deep discount, reclaimable). Savings come from right-sizing, releasing idle resources, using auto scaling to match demand, lifecycle rules on OSS, and reserved capacity for predictable load. Cost Management tools let you analyze by tag, resource group, or service.
Traps to watch
- Prepaid vs. on-demand refunds: subscription resources have different refund and renewal rules than pay-as-you-go.
- Idle resource leakage: unattached EIPs, unused disks, and forgotten snapshots accrue cost.
- Spot interruption: spot instances can be reclaimed; never run stateful, non-redundant workloads on them alone.
- Over-broad policies: wildcard actions and resources are the classic least-privilege violation.
Rule of thumb
For cost questions, apply the order: eliminate waste (idle resources) → right-size → choose the right pricing model → automate elasticity. For security questions, apply least privilege and prefer roles over keys.
Worked example
A batch job runs a few hours nightly and can tolerate interruption. Run it on spot instances orchestrated by Auto Scaling with a scheduled policy, store outputs in OSS, and use an ECS instance role for access. This cuts cost versus subscription while avoiding long-term keys.