Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Metrics, logs, alarms and dashboards for your AWS resources and applications, with alarms that notify people or act on their own.
Where CloudWatch takes you5 steps, all open
Amazon CloudWatch monitors your AWS resources and the applications you run on them. Many AWS services send it basic metrics automatically and at no charge; you can add your own metrics, collect logs, chart both on dashboards, and set alarms on them.
Alarms act. An alarm watches a metric against a threshold. When its state changes and holds, it can notify an SNS topic, run an Auto Scaling policy, or take an EC2 action, such as stopping an instance that sits idle.
The monitors on a hospital ward. Each patient is wired to a screen showing pulse and oxygen minute by minute, and the nurses' station sees every screen at once. A reading that stays out of range for long enough, not a single blip, sets off an alarm that pages a doctor, or starts a drip by itself.
MetricDimensionDashboardAlarmLogsCloudWatch agentIs CloudWatch receiving it? Memory use inside an instance arrives only if the CloudWatch agent sends it.
Is the alarm's period at least the metric's resolution? Basic EC2 metrics arrive every 5 minutes.
Have enough of the evaluation periods breached the threshold, not just one spike?
The state changed and held, so the alarm runs its actions: an SNS notification, an Auto Scaling policy or an EC2 action.
Pick a case to follow the alarm through each check.
Every signal in one service. The web servers' agent sends memory, disk and the application's logs; RDS sends its metrics on its own; CloudTrail can send API activity to a log group.
Alarms on API activity. With CloudTrail events in CloudWatch Logs, a metric filter can count a particular call and an alarm can tell the team when it happens.
Logs leave as they arrive. A subscription filter routes matching log events on to other services, such as S3 or Data Firehose, in real time.
Logs are encrypted both in transit and at rest.
Mask what is sensitive. Data protection policies audit sensitive data in log events and mask it.
Keep logs as long as the rules say. Retention is set per log group, from 1 day to 10 years, or never expiring; deletion protection stops an important log group being deleted by mistake.
Watch many accounts from one. Cross-account observability links source accounts to a central monitoring account, which can see their metrics, logs and traces.
The free tier covers basic monitoring metrics from AWS services, 10 custom metrics, 10 alarm metrics, 3 dashboards, 5 GB of log data and 1 million API requests.
Custom metrics and detailed monitoring are charged per metric; the agent's metrics count as custom metrics.
Alarms and dashboards are charged by the hour, and high-resolution alarms cost more.
Logs are charged for ingestion and storage by the GB, and Logs Insights queries by the data they scan; the Infrequent Access log class lowers the ingestion charge.
Prices change, so none are printed here. Check the CloudWatch pricing page on aws.amazon.com.
| Service | Answers | Choose it when |
|---|---|---|
| CloudWatch | How are my resources and applications behaving? | Watching behaviour and alarming on it |
| CloudTrail | Who did what in my account, and when? | Auditing the API calls made to AWS |
| EC2 monitoring | Period | Charged |
|---|---|---|
| Basic | 5 minutes; status checks every minute | No |
| Detailed | 1 minute | Per metric |
| Data points with a period of | Kept for |
|---|---|
| Under 60 seconds | 3 hours |
| 1 minute | 15 days |
| 5 minutes | 63 days |
| 1 hour | 455 days, about 15 months |
monitor memory utilisation of EC2 instancesThe CloudWatch agent
EC2 does not send memory use from inside the instance by itself.
EC2 metrics every minuteDetailed monitoring
Basic monitoring sends them every 5 minutes.
alarm on an error message in the application logsA metric filter, then an alarm
The filter turns matching log lines into a metric, from the moment it is created.
fewer, more meaningful alarmsA composite alarm
It goes into ALARM only when its rule over other alarms is met.
keep application logs for exactly one yearSet the log group's retention
By default, logs never expire.
send logs to S3 or Firehose as they arriveA subscription filter
It routes log events to other services in real time.
sub-minute metrics from an applicationHigh-resolution custom metrics
Stored at 1-second resolution; alarms on them can use 10 or 30 seconds.
find out who deleted a bucketCloudTrail, not CloudWatch
CloudWatch measures behaviour; CloudTrail records API calls.
stop EC2 instances that sit idleAn alarm with an EC2 action
An alarm can stop an instance when a metric stays low.
monitor several accounts from one placeCross-account observability
A central monitoring account views the metrics, logs and traces of the others.
An operations team runs web servers on EC2 in an Auto Scaling group. The team must be emailed when memory use on any server stays above 85 percent for 15 minutes, and error lines from the application logs must be searchable in one place. What should a solutions architect do?
Web servers send their memory use every minute. When it stays above 85 percent for 10 minutes, the on-call engineer must get an email. What watches the metric and sends the notification?
5 minutes, or every 1 with detailed monitoring.15 months, rolled up as they age.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.