Monitoring and Logging
What to know
Monitoring and logging spans CloudWatch (metrics, alarms, Logs, dashboards), CloudTrail, AWS Config, and X-Ray. Know CloudWatch metrics: default vs. custom, dimensions, detailed monitoring (1-minute) vs. basic (5-minute), and how alarms trigger actions (SNS, Auto Scaling, EC2 actions). Understand CloudWatch Logs: log groups/streams, metric filters, subscription filters (to Lambda/Kinesis/Firehose), and retention settings. Know CloudTrail for API audit (management vs. data events, multi-Region trails, organization trails) and AWS Config for resource compliance and configuration history. X-Ray traces requests across services for latency analysis. Distinguish logs (what happened in app), metrics (numeric time series), and traces (request path).
Traps
- CloudWatch Logs alone doesn't alert; you need metric filters + alarms or subscription filters.
- CloudTrail data events (S3 object-level, Lambda invocations) are off by default and cost extra.
- CloudWatch agent is required to push memory/disk metrics from EC2 - these aren't default.
- Config evaluates compliance; it doesn't block changes (that's SCPs/IAM).
Rule of thumb
"Who changed what and when?" → CloudTrail. "Is this resource compliant?" → AWS Config. "Is my app slow and where?" → X-Ray. "Alert me on a log pattern" → metric filter + alarm.
Worked example
Alert when logs contain "ERROR": create a metric filter on the log group matching the pattern, then a CloudWatch alarm on that metric that publishes to an SNS topic.