Techie BabajiLearn to Code. Build Real Skills.
AWS · Operations

CloudWatch

CloudWatch is AWS’s monitoring service: it collects metrics and logs, and alarms when something goes wrong.

Intermediate 5 min Lesson 16 of 30
Before you start:Introduction to AWS
0/30 in AWS
On this page · 5 min · Intermediate

On this page

  1. Learning objectives
  2. Explanation
  3. Code example
  4. Step by step
  5. Real-world use
  6. Common mistakes
  7. Best practices
  8. Remember this
  9. Practice exercise
  10. Mini quiz
  11. Related topics
  12. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 29, 2026

Related tutorials

Interview questions

Learning objectives#

  • Read service metrics
  • Search logs with Logs Insights
  • Create alarms with SNS notifications
  • Publish custom metrics

Explanation#

Most services publish metrics automatically: EC2 CPU, ALB request count and 5xx errors, Lambda duration and errors, RDS connections.

Logs are organised into log groups (one per app or function) and streams. Set a retention period — the default is to keep logs forever.

Logs Insights queries logs with a purpose-built query language.

Alarms watch a metric and notify an SNS topic (email, SMS, chat) or trigger scaling actions.

Code example: Alarm on Lambda errors + a Logs Insights query#

ShellAlarm on Lambda errors + a Logs Insights query Illustrative
aws sns create-topic --name oncall
aws sns subscribe --topic-arn arn:aws:sns:ap-south-1:123456789012:oncall --protocol email --notification-endpoint oncall@example.com


aws cloudwatch put-metric-alarm --alarm-name orders-errors \
  --namespace AWS/Lambda --metric-name Errors --dimensions Name=FunctionName,Value=orders \
  --statistic Sum --period 300 --evaluation-periods 1 --threshold 5 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions arn:aws:sns:ap-south-1:123456789012:oncall


aws logs put-retention-policy --log-group-name /aws/lambda/orders --retention-in-days 30


# Logs Insights:
# fields @timestamp, @message
# | filter @message like /ERROR/
# | sort @timestamp desc
# | limit 20
Expected output
When the orders function has 5 or more errors in 5 minutes, on-call receives an email. Logs are kept for 30 days.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. SNS delivers the notification by email.
  2. The alarm sums Lambda errors over 5-minute periods.
  3. Retention prevents logs from piling up cost forever.
  4. The Logs Insights query lists the latest errors.

Real-world use case#

During a sale, an alarm on ALB 5xx errors pages the team, and Logs Insights shows the failing request within seconds.

Common mistakes#

Never setting log retention

Logs default to never expire, so storage cost grows silently.

Unstructured log messages

Log JSON so you can filter by fields like orderId or userId.

Best practices#

  • Set log retention on every log group
  • Log structured JSON
  • Alarm on user-facing symptoms (errors, latency)
  • Build a dashboard per service

Remember this#

Metrics = numbers. Logs = events. Alarms = act on metrics.

Set log retention!

Alarm → SNS → your phone or inbox.

Practice exercise#

Your task: Write a Logs Insights query that counts errors per 5 minutes.

Show solution
Text Illustrative
filter @message like /ERROR/
| stats count(*) as errors by bin(5m)

Mini quiz#

CloudWatch quizMultiple choice Question 1 of 1

What is the default retention for a new CloudWatch log group?

Score so far: 0/0

Want more? Practise all AWS MCQs · AWS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.