CloudWatch metrics, logs & alarms

Alarm on signals; drive automated actions.

You cannot operate what you cannot see. Amazon CloudWatch is the observability core — metrics, logs, alarms, and dashboards — and wiring it well is what turns raw telemetry into the alerting and automated response a DevOps team relies on.

Metrics, logs, and alarms

CloudWatch collects metrics from AWS services automatically and, via the CloudWatch agent, OS-level metrics (memory, disk) and application logs the defaults miss. Logs Insights lets you query that log data interactively at scale. The action layer is alarms: an alarm watches a metric against a threshold and triggers a response — notify via SNS, trigger Auto Scaling, run an SSM Automation, or roll back a deployment. The key skill is emitting and alarming on the right signals: application-level metrics like error rate and latency that reflect what users experience, not just CPU. Custom metrics from your app make alarms meaningful.

# Alarm on application error rate, not just infrastructure — and act on it.
aws cloudwatch put-metric-alarm --alarm-name high-5xx \
  --namespace MyApp --metric-name Http5xxRate --threshold 1 \
  --comparison-operator GreaterThanThreshold --evaluation-periods 2 \
  --alarm-actions arn:aws:sns:...:oncall   # + can trigger scaling / rollback
 
# Query logs at scale for investigation:
#   CloudWatch Logs Insights: fields @timestamp,@message | filter @message like /ERROR/

From observability to action

Good observability rests on three pillars — metrics (what is happening), logs (the detail), and traces (request flow, covered next). CloudWatch dashboards visualize the state, and Synthetics canaries proactively test endpoints and user flows so you detect an outage before customers report it. But the DevOps payoff is closing the loop: connect alarms to automated response (scaling, remediation, rollback) so the system reacts in seconds without a human, and route everything to a central place for cross-account correlation. Tune alarms for signal — too many low-value alerts cause fatigue, too few miss incidents. Observability that drives automated action is what enables safe, frequent delivery and self-healing operations.