CloudWatch agent, metrics and alarms
CloudWatch is where most operational questions start. SOA-C03 (CloudOps Engineer Associate) replaced the older SOA-C02 SysOps Administrator exam, and it still expects you to know which metrics exist by default, which need the agent, and how an alarm turns a metric into an action.
Default metrics versus the agent
EC2 sends CPU, network and disk I/O (bytes and ops) and status checks to CloudWatch with no setup, every 5 minutes (1 minute with detailed monitoring). It cannot see inside the operating system, so it does not report memory, swap or disk space used.
The CloudWatch agent runs on the instance and publishes those OS-level metrics (for example mem_used_percent and disk_used_percent) as custom metrics in the CWAgent namespace. It can also ship log files to CloudWatch Logs.
To roll it out:
- Attach an instance profile with the managed policy CloudWatchAgentServerPolicy.
- Install the agent, commonly with Systems Manager Run Command (package
AmazonCloudWatch-ManageAgent). - Store the JSON configuration in Systems Manager Parameter Store so many instances share one file. To collect an extra log file on a subset of instances, add a second configuration and apply it with
append-config.
Building an alarm
An alarm watches one metric (or a math expression) and moves between OK, ALARM and INSUFFICIENT_DATA. The key settings:
| Setting | Meaning |
|---|---|
| Period | Length of each evaluation window |
| Evaluation periods / datapoints to alarm | How many windows must breach (M out of N) |
| Statistic | Average, Sum, Maximum, percentile, and so on |
| Treat missing data | Missing, notBreaching, breaching or ignore |
An alarm action can publish to an Amazon SNS topic, trigger an Auto Scaling policy, or run an EC2 action such as reboot, stop or recover. A composite alarm combines several alarms with AND/OR to cut noise.
Logs and metric filters
CloudWatch Logs stores log events. A metric filter turns matching text (for example ERROR) into a metric you can alarm on. Logs Insights queries logs interactively. Set a retention period on log groups, because the default is to keep them forever.
Watching the user experience
A CloudWatch Synthetics canary is a script (Node.js or Python) that runs on a schedule. Blueprints include a heartbeat monitor, an API canary, a broken link checker and a GUI workflow builder. Use a canary when the question says “accurate view of the user experience”. A plain load balancer metric only tells you about servers.
For Lambda, the built-in Duration metric with an alarm on Maximum above the threshold, sending to SNS, covers “notify if a function runs longer than 10 seconds”.
Exam traps
- Memory and disk space are never default EC2 metrics. “Enable detailed monitoring” does not add them.
- Detailed monitoring only changes frequency to 1 minute. It does not add new metrics.
- The agent needs an IAM role, not access keys. Missing permissions is the usual reason nothing appears.
- INSUFFICIENT_DATA is not OK. Use the missing-data setting for intermittent sources.
- Synthetics measures the user journey. Route 53 health checks and ALB metrics measure endpoints and servers.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A CloudOps engineer must alert when disk usage on Linux EC2 instances passes 80 percent. Which approach works?
Show answer
Answer: B.Disk space and memory are not default EC2 metrics. The CloudWatch agent publishes them (for example disk_used_percent) and needs CloudWatchAgentServerPolicy on the instance role.
2. A company needs an alert when its public website uptime drops and wants the test to reflect what a real user does, including a login page. What should be used?
Show answer
Answer: B.CloudWatch Synthetics canaries run scripted steps on a schedule, so they measure the real user journey, and they publish metrics you can alarm on.
3. An alarm sometimes flips to ALARM during a single short CPU spike. The team wants it to fire only when the problem is sustained. What should change?
Show answer
Answer: A.Raising the evaluation periods / datapoints to alarm requires several consecutive breaching periods before the state changes.
4. Which setting makes a CloudWatch alarm treat gaps in reporting from a stopped batch server as OK instead of INSUFFICIENT_DATA?
Show answer
Answer: A.The treat missing data option controls what the alarm does when datapoints are absent.