monitoring on Alperen Doc

aws-external-monitoring

Mon, 01 Jan 0001 00:00:00 +0000

External Monitoring#

With an EC2 instance running, we get some monitoring data automatically and at no extra charge.

There are certain things that a running instance must communicate to the hardware/system that hosts it. AWS needs to track this information “from the outside” in order to manage its infrastructure. For example:

How much CPU is the instance using?
How much network bandwidth is it taking up?
How much data is it reading from and/or writing to disk?

All these things can be monitored externally by AWS, and they package it into a service called CloudWatch Metrics. The metrics allow us to answer questions like:

aws-internal-monitoring

Mon, 01 Jan 0001 00:00:00 +0000

Internal Monitoring#

Beyond what is easily observable from the outside, there are useful things to monitor that live inside the domain of the server’s operating system. Things like:

Disk usage (i.e., how much data is on disk and how much space is free)
Memory used vs. available memory
Application logs

AWS doesn’t provide these metrics out of the box. To solve this, there are hundreds of options: Grafana, Prometheus, Datadog, Splunk, etc. AWS also provides a simple option with the CloudWatch Agent.

cloud-watch-alarms

Mon, 01 Jan 0001 00:00:00 +0000

CloudWatch Alarms#

Our metrics and logs are being sent to AWS, but we have to check them manually to find out if something is wrong. Not ideal…

CloudWatch Alarms lets us set up automatic “actions” to be taken when certain criteria are met. For example:

Our service is in an Auto Scaling Group of 1-10 servers based on CPU usage, and we just hit 10!
We have a service emitting a high number of 5XX errors!
One of our servers is at 95% disk usage!

Let’s create a simple alarm that triggers when our server goes above 20% CPU usage. When triggered, it will send a notification via SNS (Simple Notification Service) to a given email address.

cloudtrail

Mon, 01 Jan 0001 00:00:00 +0000

CloudTrail#

CloudWatch is great for monitoring our systems, but how do we get logs for the AWS account itself? Think about this:

Our CloudWatch agent is happily writing logs to CloudWatch, but what if they’re being rejected by the API?
What if the intern we fired last month changed our VPC settings? How would we know what they did?

CloudTrail is the answer. It logs the AWS API calls that we make.