Please enable JavaScript.

Coggle requires JavaScript to display documents.

Monitoring, Logging and Remediation - Coggle Diagram

- - - - Is a name/value pair that is part of the identity of a metric
        
        Dimensions describe specific characteristics of what you're measuring - think of them as categories
        
        Whenever you add a unique name/value pair to one of your metrics, you are creating a new variation of that metric
        
        For example, many Amazon EC2 metrics publish InstanceId as a dimension name, and the actual instance ID as the value for that dimension
        
        You can assign up to 30 dimensions to a metric.
      - With the CloudWatch Agent:
        
        In custom metrics CLI:
        
        aws cloudwatch put-metric-data --dimensions MyName1=MyValue1, MyName2=MyValue2
        
        aws cloudwatch get-metric-statistics --dimensions Name=MyName1, Value=MyValue1, Name=MyName2, Value=MyValue2
        
        In CloudWatch agent configuration JSON file:
        
        append_dimensions with only the following options:
        "ImageID":"${aws:ImageId}", "InstanceId":"${aws:InstanceId}", "InstanceType":"${aws:InstanceType}", "AutoScalingGroupName":"${aws:AutoScalingGroupName}"
    - - You can aggregate statistics for your EC2 instances that have detailed monitoring enabled
        
        Instances that use basic monitoring are not included
      - You can aggregate the metrics for AWS resources across multiple resources
        
        Metrics are completely separate between Regions, but you can use metric math to aggregate similar metrics across Regions
        
        Roll-up Retention: As data gets older, CloudWatch automatically "rolls it up" into larger buckets. E.g. 1-minute kept for 15 days, then aggregated into 5-minute
      - Metric Math
        
        Query multiple CloudWatch metrics and use math expressions to create new time series based on these metrics
        
        Allows to aggregate and transform metrics from multiple accounts and Regions
        
        Create alarms based on Metric Math expressions
        
        Visualize the resulting time series on the CloudWatch console and add them to dashboards
        
        Anomaly detection on metric math is a feature that you can use to create anomaly detection alarms on single metrics and the outputs of metric math expressions
        
        Example: divide the Lambda Errors metric by the Lambda Invocations metric to get an error rate
      - Metric Insight
        
        Use SQL to group and filter thousands of metrics across tags or regions instantly
    - - Is a container for CloudWatch metrics that isolates metrics from different applications or services
        
        Metrics in different namespaces are isolated from each other to prevent accidental aggregation across applications
        
        There is no default namespace - you must specify one for each data point you publish
        
        AWS service namespaces follow the convention AWS/service (e.g., AWS/Lambda, AWS/EC2)
        
        Custom namespaces should avoid starting with "AWS/" and must be fewer than 256 characters
    - - Use API call PutMetricData or put-metric-data command
        
        Add Dimensions to segment metrics (instanceId, environment)
        
        Metric resolution
        
        Set with --storage-resolution
        
        Default is 1 minute
        
        You can configure high-resolution intervals: 1/5/10/15 seconds
        
        Accept 2 weeks in the past and 2 hours in the future with --timestamp
        
        If you do not set --timestamp, CloudWatch automatically assigns the time the metric data was received
  - - - Interactive query and analysis for data stored in CloudWatch Logs
        
        Query and filter logs directly
        
        Generate visualization e.g. bar graph, line graph or pie chart
      - Run queries to:
        
        filter logs (with basic bar chart on top of results)
        
        create visualization charts (line, stacked area, bar and pie)
        
        export results in various format (markdown, CSV, JSON, CSV, XLSX) either by copying to clipboard or downloading table
        
        add your result to a dashboard
      - Examples:
        
        Lambda
        
        View latency statistics for 5-minute intervals
        
        Determine the amount of overprovisioned memory
        
        Find the most expensive requests
        
        VPC Flow Logs
        
        CloudTrail
        
        Common queries
        
        25 most recently added log events
        
        Number of exceptions logged every 5 minutes
        
        Route53
        
        AWS AppSynch
        
        NAT Gateway
- - - - A rule matches incoming events or a rule schedule and sends them to targets for processing.
      - Rule detail
        
        Event Bus default vs custom, receive events from resources that emit events: 1) AWS services in your account or in other accounts, 2) SaaS partner services and 3) applications, and your own custom applications. When an event bus receives an event, EventBridge then checks whether the event matches the conditions of the rules associated with that event bus
        
        Rule type
        
        Rule with an event pattern
        
        Schedule
        
        Cron expression: a fine-grained schedule that runs at a specific time, such as 8:00 a.m. PST on the first Monday of every month
        
        Rate expression: a schedule that runs at a regular rate (Minutes, Hours, Day), such as every 10 minutes
        
        Event source
        
        AWS events or EventBridge partner events - Events sent from AWS services or EventBridge partners
        
        Other - custom events or events sent from more than one source, e.g. events from AWS services and partners
        
        All events - all events sent to your account
        
        Creation method - Event Pattern
        
        Use schema - use an Amazon EventBridge schema to generate the event pattern
        
        Select schema from Schema registry
        
        Enter schema
        
        Use pattern form - use a template provided by EventBridge to create an event pattern
        
        Event source - AWS service or EventBridge partner as source
        
        AWS service - the name of the AWS service as the event source
        
        Event type - the type of events as the source of the matching pattern
        
        Custom pattern (JSON editor) - write a pattern in JSON
        
        Target(s)
        
        Target types
        
        EventBridge event bus also in a different Account
        
        EventBridge API Destination - HTTP endpoints that you can invoke
        
        AWS service
        
        Enable Target input transformation to customize the text from an event before EventBridge send to the target
        
        Part of the matched event - specify the part of the event text is sent
        
        Constant (JSON text)
        
        Input transformer - specify how to change some of the event text before passing it to the target.
        
        Input path - Define key-value pairs to extract event values. Use JSON path to reference fields in your event, and store those field values in variables
        
        Template - Define how to format the event information retrieved by the input path, prior to it being sent to the target (JSON or text)
      - Bus
        
        An Event Rule works with a Event Bus
        
        Default Bus (AWS services events)
        
        Partner specific Event bus (Partner events)
        
        Custom buses (Custom application events)
        
        Event bus receive events from a variety of sources and match them to rules in your account
        
        Create Archives with encryption (AWS owned key or KMS key) and retention period (indefinite vs custom days)
        
        Reply archives
    - - A pipe connects an event source to a target with optional filtering and enrichment
      - Sources: receive events from a variety of sources, including DynamoDB, Kinesis, and SQS
        
        Filtering: define an event pattern to filter the events that are sent through the pipe
        
        Enrichment: transform your event or pull additional data into it using Lambda, Step Functions, or an API
        
        Target: send your event to an AWS service, an event bus, or an API destination
    - - A schedule invokes a target one-time or at regular intervals defined by a cron or rate expression
        
        A new EventBridge scheduling functionality that provides one-time and recurring scheduling functionality independent of Event buses and rules. You can create a schedule to invoke targets such as a Lambda function
        
        Does not rely on event bus
      - Schedule pattern:
        
        One-time schedule
        
        Recurring schedule (Cron vs Rate such as Scheduled Rules)
    - - Schema registries collect and organize schemas
        
        Browse or search for the schemas of all AWS services on EventBridge
        
        Automatically generate schemas for events on an event bus, create or upload custom schemas, and organize your custom schemas in custom registries
      - Schema defines the structure and content of events that are passed on an event bus in EventBridge
        
        AWS event schema registry
        
        Discovered schema registry (need to enable discovery on an event bus to automatically generate schemas)
        
        Custom schema registry
    - - Partner event source:
        
        Select partner event source
        
        Copy your AWS account information
        
        Create event bus for the selected partner (in partner tool/service)
        
        Associate the partner event source with an event bus in your account
      - API destinations:
        
        API destinations are third-party partner targets that you can invoke using an HTTPS endpoint
        
        Make use of Connections for EventBridge to use in connecting to a public or private API
        
        Authorization method and credentials
        
        network connectivity for both public and private APIs