Please enable JavaScript.

Coggle requires JavaScript to display documents.

AWS Monitoring & Audit - Coggle Diagram

- - - - belong to namespace
      - dimension (attribute): <= 30 / metric
      - timestamp
      - variable
      - can have metrics dashboard
    - - normal: 5min; detail: 1min; 10 detail free tier
      - ec2 memory usage:
        not pushed default
    - - call: PutMetricData (id, env.name)
        CLI: put-metric-data
        
        StorageResolution params
        
        standard: 1min;
        
        high resolution: 1/5/10/30 - $$$
        
        important: metric point: -2 week -> + 2 week
    - - 5min
  - - - Log stream
      - Expiration policy
        
        default: never expired
      - Characteristic
        
        enable by default
      - Log groups (filter pattern)
    - - SDK, Logs Agent, Unified Agent
        
        Logs Agent
        
        Default: no log from EC2
        
        EC2 -> LogAgent -> CLoudWatch
        
        Unified Agent:
        additional system-level metric
        
        CPU, Disk, Ram, netstat, process, swap
      - Elastic Beanstask
      - ECS
      - AWS lambda
      - VPC Flow logs
      - CloudTrail
      - Route53
    - - search & analyze logs
        
        query engine
      - multiple account
    - - Subscription filter
        (filter log -> dest)
        
        Logs Aggregation
        multi-account & multi-region
        
        Sub filter (Account 1) -> Sub destination (Account 2)
    - - not retroactively filter
      - max: 3 dimension / metric filter
      - log -> filter -> alarm -> sns
  - - - Schedule
      - Event pattern
    - - AWS service -> Default event bus (event)
      - Partner -> partner bus
      - custom app -> custom event bus
      - can: archive event -> event bus
      - can: replay archived event
    - - EventBridge anaylze -> schema -> schema registry -> code
      - can be version
    - - events:PutEvents
  - - - OK, INSUFFICINT_DATA, ALARM
    - - high resolution: 10,30,60s
    - - stop,reboot,terminate, recovery EC2; auto scaling, SNS
    - - operator: AND | OR
    - - set-alarm-state
    - - blueprint
        
        heartbeat monitor
        
        load URL store screenshoot & HTTP archive
        
        API canary
        
        test read write restfuil API
        
        broken link checker
        
        check in inside URL
        
        visual monitor: compare screenshot & baseline
        
        canary recorder: record action & generate script
        
        GUI workflow builder
- - - - must have IAM right
      - AWS lambda (already having)
    - - enable X-Ray active tracing
  - - - default: req / second (reservoir), 5% additional request (rate)
    - - key-value: index trace - use with filter
    - - not indexed - user for search
  - - - PutTelemetryRecord
        
        SegmentsReceivedCount
        
        SegmentRejectedCount
        
        BackendConnectionErrors
      - GetSamplingRules
      - GetSampleTargets &
        GetSamplingStatisticSummeries
      - PutTraceSegments
    - - GetServiceGraph
      - BatchGetTraces
      - GetTraceSummeries
      - GetTraceGraph
  - - - X-ray container as deamon / instance
      - sidecar: 1 x-ray container / 1 app container
      - Fargate: only sidecar container
      - conatinerPort: 2000 , protocol: udp
      - AWS_XRAY_DEAMON_ADDRESS: <container_name>:<port>
- - - - detect unusual activity
        
        continuously analyze write