[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"next-aws-certified-cloudops-engineer-associate-monitoring-logging-performance-alarms-dashboards-and-notifications-sns-for-operational-alerting-en":4,"lesson-aws-certified-cloudops-engineer-associate-monitoring-logging-performance-alarms-dashboards-and-notifications-sns-for-operational-alerting-en":19,"prev-aws-certified-cloudops-engineer-associate-monitoring-logging-performance-alarms-dashboards-and-notifications-sns-for-operational-alerting-en":32},null,{"locked":5,"reason":6,"meta":7,"item":3},true,"paywall",{"title":8,"description":9,"isFree":10,"estimatedMinutes":11,"difficulty":12,"learningObjectives":13},"Composite Alarms and Alarm Actions","Turn a wall of individual alarms into one signal with composite alarm rule expressions and action suppression, and make alarms fix things instead of just reporting them with EC2, Auto Scaling, Lambda, and Systems Manager actions.",false,22,"advanced",[14,15,16,17,18],"Write a composite alarm rule expression using ALARM, OK, INSUFFICIENT_DATA, AND, OR, and NOT","Explain which actions a composite alarm can and cannot perform","Configure an actions suppressor with WaitPeriod and ExtensionPeriod to silence expected alarms during maintenance","Choose between the reboot and recover EC2 alarm actions from the status check that failed","Identify the prerequisites and constraints of each alarm action type",{"locked":5,"reason":6,"meta":20,"item":3},{"title":21,"description":22,"isFree":10,"estimatedMinutes":23,"difficulty":24,"learningObjectives":25},"SNS for Operational Alerting","How an alarm notification actually reaches a human: SNS topics and subscriptions, the confirmation step that silently breaks alerting, filter policies, retry behavior per protocol, dead-letter queues, and the KMS permission that stops encrypted topics from receiving alarms.",20,"intermediate",[26,27,28,29,30,31],"Describe the publisher, topic, and subscription model and the endpoint types SNS can deliver to","Explain why an unconfirmed email subscription produces an alarm that appears to work but notifies nobody","Use subscription filter policies to route one topic to different audiences","Compare SNS retry behavior for AWS managed endpoints and customer managed endpoints","Configure a dead-letter queue and explain why it attaches to a subscription rather than a topic","Diagnose an encrypted SNS topic that never receives alarm notifications",{"locked":10,"reason":3,"meta":33,"item":43},{"title":34,"description":35,"isFree":5,"estimatedMinutes":11,"difficulty":24,"learningObjectives":36},"CloudWatch Alarms Fundamentals","How a CloudWatch alarm decides to change state: period, evaluation periods, datapoints to alarm, the evaluation range it quietly reaches back into, and the missing-data setting that decides whether silence means healthy or broken.",[37,38,39,40,41,42],"Identify the settings that make up a metric alarm and explain what each one controls","Explain why an alarm invokes its actions only on a state change, and name the one exception","Configure an M out of N alarm and predict its state from a sequence of data points","Choose the right missing-data treatment for a given metric and justify it","Diagnose an alarm stuck in INSUFFICIENT_DATA","Compare static-threshold, metric math, and anomaly detection alarms",{"id":44,"title":34,"body":45,"description":35,"difficulty":24,"estimatedMinutes":11,"extension":1494,"infographics":1495,"isFree":5,"learningObjectives":1510,"meta":1511,"navigation":5,"path":1512,"quiz":1513,"seo":1569,"stem":1570,"__hash__":1571},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/01-monitoring-logging-performance/02-alarms-dashboards-and-notifications/01-cloudwatch-alarms-fundamentals.md",{"type":46,"value":47,"toc":1483},"minimark",[48,61,64,69,72,140,143,157,325,329,332,355,360,367,370,377,381,384,389,394,403,410,415,422,429,436,440,447,450,517,533,546,550,553,564,567,586,589,597,612,616,623,633,637,640,646,1055,1068,1074,1309,1315,1343,1346,1350,1353,1386,1397,1443,1447,1476,1479],[49,50,51,52,56,57,60],"p",{},"Two alarms, same night, same account. The first never fired while the payment queue backed up for 40 minutes. The second fired 14 times between 02:00 and 03:00 while nothing was actually wrong. Both were built by engineers who knew exactly what ",[53,54,55],"code",{},"CPUUtilization"," and ",[53,58,59],{},"ApproximateAgeOfOldestMessage"," mean. Neither knew how CloudWatch decides when an alarm changes state.",[49,62,63],{},"That decision is where alarms are won and lost. A metric is just a list of numbers, and you already know how CloudWatch stores them. An alarm is a small state machine sitting on top of that list, and almost every alarm complaint in production traces back to one of four settings inside it.",[65,66,68],"h2",{"id":67},"what-an-alarm-is-made-of","What an alarm is made of",[49,70,71],{},"A metric alarm watches one metric (or one metric math expression) and holds one of three states. To decide which, it needs answers to six questions:",[73,74,75,88],"table",{},[76,77,78],"thead",{},[79,80,81,85],"tr",{},[82,83,84],"th",{},"Setting",[82,86,87],{},"The question it answers",[89,90,91,100,108,116,124,132],"tbody",{},[79,92,93,97],{},[94,95,96],"td",{},"Metric and dimensions",[94,98,99],{},"Which numbers am I watching?",[79,101,102,105],{},[94,103,104],{},"Statistic",[94,106,107],{},"How do I collapse a batch of raw values into one number?",[79,109,110,113],{},[94,111,112],{},"Period",[94,114,115],{},"How wide is a batch, in seconds?",[79,117,118,121],{},[94,119,120],{},"Threshold and comparison operator",[94,122,123],{},"What counts as bad?",[79,125,126,129],{},[94,127,128],{},"Evaluation Periods (N)",[94,130,131],{},"How many recent data points do I look at?",[79,133,134,137],{},[94,135,136],{},"Datapoints to Alarm (M)",[94,138,139],{},"How many of those must be bad before I react?",[49,141,142],{},"A seventh setting, the missing-data treatment, only matters when data goes silent, and it gets its own section below because it causes more surprises than the other six combined.",[49,144,145,146,148,149,152,153,156],{},"Here is one alarm with real values: watch ",[53,147,55],{}," for instance ",[53,150,151],{},"i-0a1b2c3d4e5f67890",", take the ",[53,154,155],{},"Average"," over each 60-second period, call a period bad when the average is above 80, and go to ALARM when 3 of the last 5 periods were bad.",[158,159,164],"pre",{"className":160,"code":161,"language":162,"meta":163,"style":163},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","aws cloudwatch put-metric-alarm \\\n  --alarm-name \"checkout-api-cpu-high\" \\\n  --namespace AWS/EC2 \\\n  --metric-name CPUUtilization \\\n  --dimensions Name=InstanceId,Value=i-0a1b2c3d4e5f67890 \\\n  --statistic Average \\\n  --period 60 \\\n  --threshold 80 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 5 \\\n  --datapoints-to-alarm 3 \\\n  --treat-missing-data missing \\\n  --alarm-actions arn:aws:sns:eu-west-1:111122223333:ops-critical\n","bash","",[53,165,166,186,205,216,227,238,249,261,272,283,294,305,316],{"__ignoreMap":163},[167,168,171,175,179,182],"span",{"class":169,"line":170},"line",1,[167,172,174],{"class":173},"sbgvK","aws",[167,176,178],{"class":177},"s_sjI"," cloudwatch",[167,180,181],{"class":177}," put-metric-alarm",[167,183,185],{"class":184},"s_hVV"," \\\n",[167,187,189,193,197,200,203],{"class":169,"line":188},2,[167,190,192],{"class":191},"stzsN","  --alarm-name",[167,194,196],{"class":195},"sjJ54"," \"",[167,198,199],{"class":177},"checkout-api-cpu-high",[167,201,202],{"class":195},"\"",[167,204,185],{"class":184},[167,206,208,211,214],{"class":169,"line":207},3,[167,209,210],{"class":191},"  --namespace",[167,212,213],{"class":177}," AWS/EC2",[167,215,185],{"class":184},[167,217,219,222,225],{"class":169,"line":218},4,[167,220,221],{"class":191},"  --metric-name",[167,223,224],{"class":177}," CPUUtilization",[167,226,185],{"class":184},[167,228,230,233,236],{"class":169,"line":229},5,[167,231,232],{"class":191},"  --dimensions",[167,234,235],{"class":177}," Name=InstanceId,Value=i-0a1b2c3d4e5f67890",[167,237,185],{"class":184},[167,239,241,244,247],{"class":169,"line":240},6,[167,242,243],{"class":191},"  --statistic",[167,245,246],{"class":177}," Average",[167,248,185],{"class":184},[167,250,252,255,259],{"class":169,"line":251},7,[167,253,254],{"class":191},"  --period",[167,256,258],{"class":257},"srdBf"," 60",[167,260,185],{"class":184},[167,262,264,267,270],{"class":169,"line":263},8,[167,265,266],{"class":191},"  --threshold",[167,268,269],{"class":257}," 80",[167,271,185],{"class":184},[167,273,275,278,281],{"class":169,"line":274},9,[167,276,277],{"class":191},"  --comparison-operator",[167,279,280],{"class":177}," GreaterThanThreshold",[167,282,185],{"class":184},[167,284,286,289,292],{"class":169,"line":285},10,[167,287,288],{"class":191},"  --evaluation-periods",[167,290,291],{"class":257}," 5",[167,293,185],{"class":184},[167,295,297,300,303],{"class":169,"line":296},11,[167,298,299],{"class":191},"  --datapoints-to-alarm",[167,301,302],{"class":257}," 3",[167,304,185],{"class":184},[167,306,308,311,314],{"class":169,"line":307},12,[167,309,310],{"class":191},"  --treat-missing-data",[167,312,313],{"class":177}," missing",[167,315,185],{"class":184},[167,317,319,322],{"class":169,"line":318},13,[167,320,321],{"class":191},"  --alarm-actions",[167,323,324],{"class":177}," arn:aws:sns:eu-west-1:111122223333:ops-critical\n",[65,326,328],{"id":327},"three-states-and-the-rule-almost-everyone-gets-wrong","Three states, and the rule almost everyone gets wrong",[49,330,331],{},"An alarm is always in exactly one of these:",[333,334,335,343,349],"ul",{},[336,337,338,342],"li",{},[339,340,341],"strong",{},"OK",": the metric is within the threshold.",[336,344,345,348],{},[339,346,347],{},"ALARM",": the metric is outside the threshold.",[336,350,351,354],{},[339,352,353],{},"INSUFFICIENT_DATA",": the alarm just started, the metric is not available, or there is not enough data to decide.",[49,356,357,359],{},[53,358,353],{}," is not an error. A brand new alarm starts there by design, and an EBS volume that is available but not attached to any instance stops publishing metrics, which is a perfectly healthy reason for its alarm to sit in that state.",[49,361,362,363,366],{},"Now the rule: ",[339,364,365],{},"an alarm invokes its actions only when the alarm changes state."," Not every period. Not every minute. Once, on the transition.",[49,368,369],{},"It is tempting to assume that an alarm stuck in ALARM keeps paging you, and that a silent phone means the problem cleared. Neither is true. The alarm sent one notification when it crossed into ALARM and has been quietly sitting there ever since. If your process needs repeated reminders while an incident is open, that repetition comes from your paging tool, not from CloudWatch.",[49,371,372,373,376],{},"There is exactly one exception, and the exam likes it: for ",[339,374,375],{},"Auto Scaling actions",", the alarm continues to invoke the action once per minute for as long as it stays in the new state. That is deliberate, because a scaling policy that fired once and then went quiet would never finish scaling out a badly overloaded group.",[65,378,380],{"id":379},"period-evaluation-periods-and-datapoints-to-alarm","Period, Evaluation Periods, and Datapoints to Alarm",[49,382,383],{},"These three settings are where the \"never fired\" and \"fired 14 times\" alarms come from, so work through them with numbers rather than definitions.",[49,385,386,388],{},[339,387,112],{}," is how much time each data point covers. Valid values are 10, 20, 30, or any multiple of 60 seconds.",[49,390,391,393],{},[339,392,128],{}," is how many of the most recent data points the alarm looks at.",[49,395,396,398,399,402],{},[339,397,136],{}," is how many of those N must be breaching for the alarm to go to ALARM. The breaching points ",[339,400,401],{},"do not have to be consecutive",". They only have to fall inside the window of the last N.",[49,404,405,406,409],{},"When M equals N, you have a \"consecutive periods\" alarm: every point in the window must be breaching. When M is smaller than N, you have an ",[339,407,408],{},"M out of N alarm",", and it tolerates a healthy blip in the middle of a bad stretch.",[411,412],"infographic",{"alt":413,"slug":414},"A strip of five metric data points showing how a 3-out-of-5 CloudWatch alarm reads its evaluation window, with breaching points scattered rather than consecutive.","alarm-m-out-of-n-evaluation",[49,416,417,418,421],{},"The ",[339,419,420],{},"evaluation interval"," is simply N multiplied by the period. Four out of five data points at a 1-minute period is a 5-minute interval. Three out of three at a 10-minute period is a 30-minute interval.",[49,423,424,425,428],{},"For any period of one minute or longer, the alarm is evaluated ",[339,426,427],{},"every minute",", and the window slides. With a 5-minute period and 1 evaluation period, the end of minute 5 evaluates minutes 1 through 5, and the end of minute 6 evaluates minutes 2 through 6. If the period is 10, 20, or 30 seconds, the alarm is evaluated every 10 seconds instead.",[49,430,431,432,435],{},"Two quotas bound how far back an alarm can look. Period multiplied by Evaluation Periods can be at most 604,800 seconds (seven days) for alarms with a period of at least one hour, and at most 86,400 seconds (one day) for anything shorter. And an alarm whose window exceeds one day becomes a ",[339,433,434],{},"multi-day alarm",", which is evaluated only once per hour and takes into account only metrics up to the current hour at the :00 minute. A job that fails at 10:02 will not move such an alarm at 10:03; the alarm reacts at 11:03.",[65,437,439],{"id":438},"missing-data-what-silence-means","Missing data: what silence means",[49,441,442,443,446],{},"Every data point in the window is one of three things: not breaching, breaching, or ",[339,444,445],{},"missing",". The first two are obvious. The third is a judgment call that only you can make, because CloudWatch has no way to know whether a metric that went quiet means \"everything is fine\" or \"the thing that publishes this metric is dead\".",[49,448,449],{},"So you tell it, with one of four settings:",[73,451,452,464],{},[76,453,454],{},[79,455,456,458,461],{},[82,457,84],{},[82,459,460],{},"Missing points are treated as",[82,462,463],{},"Use it when",[89,465,466,479,492,505],{},[79,467,468,473,476],{},[94,469,470],{},[53,471,472],{},"notBreaching",[94,474,475],{},"good, within the threshold",[94,477,478],{},"the metric only publishes when something is wrong",[79,480,481,486,489],{},[94,482,483],{},[53,484,485],{},"breaching",[94,487,488],{},"bad, violating the threshold",[94,490,491],{},"silence means the reporter died, and that is an incident",[79,493,494,499,502],{},[94,495,496],{},[53,497,498],{},"ignore",[94,500,501],{},"not evaluated; the current state is retained",[94,503,504],{},"you would rather hold the last known state than guess",[79,506,507,511,514],{},[94,508,509],{},[53,510,445],{},[94,512,513],{},"not enough data; alarm goes to INSUFFICIENT_DATA if all points are missing",[94,515,516],{},"the default, and the honest answer when you do not know",[49,518,519,520,522,523,526,527,529,530,532],{},"The default is ",[53,521,445],{},". Two exceptions are worth memorizing. Alarms on metrics in the ",[53,524,525],{},"AWS/DynamoDB"," namespace always default to ",[53,528,498],{},". And AWS specifically recommends ",[53,531,445],{}," for alarms that stop, terminate, reboot, or recover EC2 instances, because EC2 metric reporting can be interrupted briefly on a perfectly healthy instance, and you do not want a gap in reporting to terminate a production server.",[49,534,535,536,539,540,542,543,545],{},"Concrete picks: DynamoDB ",[53,537,538],{},"ThrottledRequests"," publishes a data point only when a request is throttled, so ",[53,541,472],{}," is right. An alarm that triggers a deployment rollback watches a metric that reports continuously, so a gap probably means the app stopped answering, and ",[53,544,485],{}," is right.",[65,547,549],{"id":548},"the-evaluation-range-and-why-your-missing-data-setting-is-often-ignored","The evaluation range, and why your missing-data setting is often ignored",[49,551,552],{},"Here is the part that makes alarms behave in ways the settings do not obviously predict.",[49,554,555,556,559,560,563],{},"Whenever an alarm evaluates, CloudWatch retrieves ",[339,557,558],{},"more data points than Evaluation Periods",". The time frame of those extra points is called the ",[339,561,562],{},"evaluation range",". For an alarm with 3 evaluation periods, the evaluation range is 5 data points.",[49,565,566],{},"Then it applies three rules in order:",[568,569,570,573,583],"ol",{},[336,571,572],{},"If no points in the evaluation range are missing, it evaluates the most recent N and ignores the extras.",[336,574,575,576,579,580],{},"If some are missing but the total number of real points retrieved is at least N, it evaluates the most recent N ",[339,577,578],{},"real"," points, reaching back into the extras. ",[339,581,582],{},"Your missing-data setting is not used at all.",[336,584,585],{},"Only if real points are still fewer than N does CloudWatch fill the gaps using your missing-data setting, and even then it uses as few substituted points as possible.",[49,587,588],{},"Think of it as a teacher grading your last 3 homework scores. If two of the last 3 were never handed in, the teacher reaches back to the 4th and 5th assignment rather than marking the missing ones as zero. The analogy breaks in one place: the teacher would keep reaching back indefinitely, while CloudWatch only reaches as far as the evaluation range and then falls back to your setting.",[49,590,591,592,56,594,596],{},"This is why two engineers can set ",[53,593,485],{},[53,595,472],{}," on the same intermittent metric and watch both alarms behave identically for weeks.",[49,598,599,600,603,604,607,608,611],{},"There is one more piece of logic in there, called ",[339,601,602],{},"premature alarm state"," avoidance. With Datapoints to Alarm set to 3, data of ",[53,605,606],{},"- - - - X"," (four missing, then one breaching) does not immediately go to ALARM, because the next point might be healthy. But data of ",[53,609,610],{},"- - X - -"," does go to ALARM even with missing treated as missing, because the oldest available breaching point is at least as old as the value of M and everything newer is breaching or missing. Do not expect the missing-data table alone to predict these edges.",[65,613,615],{"id":614},"high-resolution-alarms","High-resolution alarms",[49,617,618,619,622],{},"Set the period to 10, 20, or 30 seconds and you have created a ",[339,620,621],{},"high-resolution alarm",", evaluated every 10 seconds and billed at a higher rate than a normal alarm.",[49,624,625,626,629,630,632],{},"Use those periods ",[339,627,628],{},"only"," for metrics that were published with a storage resolution of 1, meaning your own high-resolution custom metrics. Point a 10-second alarm at a standard-resolution metric and CloudWatch still tries to gather data every 10 seconds, finds nothing for five out of six attempts, and drops the alarm into ",[53,631,353],{}," regularly. You get an unreliable alarm and the premium price at the same time.",[65,634,636],{"id":635},"beyond-a-static-number","Beyond a static number",[49,638,639],{},"Not every question has a fixed threshold, and CloudWatch gives you two ways past that.",[49,641,642,645],{},[339,643,644],{},"Metric math alarms"," watch the output of an expression rather than a raw metric. The classic case is an error rate, because \"500 errors\" means something completely different at 600 requests than at 6 million:",[158,647,651],{"className":648,"code":649,"language":650,"meta":163,"style":163},"language-json shiki shiki-themes material-theme-lighter github-light github-dark","{\n  \"Metrics\": [\n    { \"Id\": \"errors\",   \"MetricStat\": { \"Metric\": { \"Namespace\": \"MyService\", \"MetricName\": \"ConnectionsFailed\" }, \"Period\": 60, \"Stat\": \"Sum\" }, \"ReturnData\": false },\n    { \"Id\": \"attempts\", \"MetricStat\": { \"Metric\": { \"Namespace\": \"MyService\", \"MetricName\": \"ConnectionAttempts\" }, \"Period\": 60, \"Stat\": \"Sum\" }, \"ReturnData\": false },\n    { \"Id\": \"error_rate\", \"Expression\": \"(errors/attempts)*100\", \"ReturnData\": true, \"Label\": \"Connection error rate\" }\n  ],\n  \"Threshold\": 40,\n  \"ComparisonOperator\": \"GreaterThanThreshold\",\n  \"EvaluationPeriods\": 3\n}\n","json",[53,652,653,659,677,809,923,994,999,1016,1036,1050],{"__ignoreMap":163},[167,654,655],{"class":169,"line":170},[167,656,658],{"class":657},"sP7_E","{\n",[167,660,661,665,669,671,674],{"class":169,"line":188},[167,662,664],{"class":663},"s39Yj","  \"",[167,666,668],{"class":667},"sseR_","Metrics",[167,670,202],{"class":663},[167,672,673],{"class":657},":",[167,675,676],{"class":657}," [\n",[167,678,679,682,684,688,690,692,694,697,699,702,705,708,710,712,715,717,720,722,724,726,728,732,734,736,738,741,743,745,747,750,752,754,756,759,761,764,766,768,770,772,774,776,778,781,783,785,787,790,792,794,796,799,801,803,806],{"class":169,"line":207},[167,680,681],{"class":657},"    {",[167,683,196],{"class":663},[167,685,687],{"class":686},"sZMiF","Id",[167,689,202],{"class":663},[167,691,673],{"class":657},[167,693,196],{"class":195},[167,695,696],{"class":177},"errors",[167,698,202],{"class":195},[167,700,701],{"class":657},",",[167,703,704],{"class":663},"   \"",[167,706,707],{"class":686},"MetricStat",[167,709,202],{"class":663},[167,711,673],{"class":657},[167,713,714],{"class":657}," {",[167,716,196],{"class":663},[167,718,719],{"class":257},"Metric",[167,721,202],{"class":663},[167,723,673],{"class":657},[167,725,714],{"class":657},[167,727,196],{"class":663},[167,729,731],{"class":730},"swQdS","Namespace",[167,733,202],{"class":663},[167,735,673],{"class":657},[167,737,196],{"class":195},[167,739,740],{"class":177},"MyService",[167,742,202],{"class":195},[167,744,701],{"class":657},[167,746,196],{"class":663},[167,748,749],{"class":730},"MetricName",[167,751,202],{"class":663},[167,753,673],{"class":657},[167,755,196],{"class":195},[167,757,758],{"class":177},"ConnectionsFailed",[167,760,202],{"class":195},[167,762,763],{"class":657}," },",[167,765,196],{"class":663},[167,767,112],{"class":257},[167,769,202],{"class":663},[167,771,673],{"class":657},[167,773,258],{"class":257},[167,775,701],{"class":657},[167,777,196],{"class":663},[167,779,780],{"class":257},"Stat",[167,782,202],{"class":663},[167,784,673],{"class":657},[167,786,196],{"class":195},[167,788,789],{"class":177},"Sum",[167,791,202],{"class":195},[167,793,763],{"class":657},[167,795,196],{"class":663},[167,797,798],{"class":686},"ReturnData",[167,800,202],{"class":663},[167,802,673],{"class":657},[167,804,805],{"class":663}," false",[167,807,808],{"class":657}," },\n",[167,810,811,813,815,817,819,821,823,826,828,830,832,834,836,838,840,842,844,846,848,850,852,854,856,858,860,862,864,866,868,870,872,874,876,879,881,883,885,887,889,891,893,895,897,899,901,903,905,907,909,911,913,915,917,919,921],{"class":169,"line":218},[167,812,681],{"class":657},[167,814,196],{"class":663},[167,816,687],{"class":686},[167,818,202],{"class":663},[167,820,673],{"class":657},[167,822,196],{"class":195},[167,824,825],{"class":177},"attempts",[167,827,202],{"class":195},[167,829,701],{"class":657},[167,831,196],{"class":663},[167,833,707],{"class":686},[167,835,202],{"class":663},[167,837,673],{"class":657},[167,839,714],{"class":657},[167,841,196],{"class":663},[167,843,719],{"class":257},[167,845,202],{"class":663},[167,847,673],{"class":657},[167,849,714],{"class":657},[167,851,196],{"class":663},[167,853,731],{"class":730},[167,855,202],{"class":663},[167,857,673],{"class":657},[167,859,196],{"class":195},[167,861,740],{"class":177},[167,863,202],{"class":195},[167,865,701],{"class":657},[167,867,196],{"class":663},[167,869,749],{"class":730},[167,871,202],{"class":663},[167,873,673],{"class":657},[167,875,196],{"class":195},[167,877,878],{"class":177},"ConnectionAttempts",[167,880,202],{"class":195},[167,882,763],{"class":657},[167,884,196],{"class":663},[167,886,112],{"class":257},[167,888,202],{"class":663},[167,890,673],{"class":657},[167,892,258],{"class":257},[167,894,701],{"class":657},[167,896,196],{"class":663},[167,898,780],{"class":257},[167,900,202],{"class":663},[167,902,673],{"class":657},[167,904,196],{"class":195},[167,906,789],{"class":177},[167,908,202],{"class":195},[167,910,763],{"class":657},[167,912,196],{"class":663},[167,914,798],{"class":686},[167,916,202],{"class":663},[167,918,673],{"class":657},[167,920,805],{"class":663},[167,922,808],{"class":657},[167,924,925,927,929,931,933,935,937,940,942,944,946,949,951,953,955,958,960,962,964,966,968,970,973,975,977,980,982,984,986,989,991],{"class":169,"line":229},[167,926,681],{"class":657},[167,928,196],{"class":663},[167,930,687],{"class":686},[167,932,202],{"class":663},[167,934,673],{"class":657},[167,936,196],{"class":195},[167,938,939],{"class":177},"error_rate",[167,941,202],{"class":195},[167,943,701],{"class":657},[167,945,196],{"class":663},[167,947,948],{"class":686},"Expression",[167,950,202],{"class":663},[167,952,673],{"class":657},[167,954,196],{"class":195},[167,956,957],{"class":177},"(errors/attempts)*100",[167,959,202],{"class":195},[167,961,701],{"class":657},[167,963,196],{"class":663},[167,965,798],{"class":686},[167,967,202],{"class":663},[167,969,673],{"class":657},[167,971,972],{"class":663}," true",[167,974,701],{"class":657},[167,976,196],{"class":663},[167,978,979],{"class":686},"Label",[167,981,202],{"class":663},[167,983,673],{"class":657},[167,985,196],{"class":195},[167,987,988],{"class":177},"Connection error rate",[167,990,202],{"class":195},[167,992,993],{"class":657}," }\n",[167,995,996],{"class":169,"line":240},[167,997,998],{"class":657},"  ],\n",[167,1000,1001,1003,1006,1008,1010,1013],{"class":169,"line":251},[167,1002,664],{"class":663},[167,1004,1005],{"class":667},"Threshold",[167,1007,202],{"class":663},[167,1009,673],{"class":657},[167,1011,1012],{"class":257}," 40",[167,1014,1015],{"class":657},",\n",[167,1017,1018,1020,1023,1025,1027,1029,1032,1034],{"class":169,"line":263},[167,1019,664],{"class":663},[167,1021,1022],{"class":667},"ComparisonOperator",[167,1024,202],{"class":663},[167,1026,673],{"class":657},[167,1028,196],{"class":195},[167,1030,1031],{"class":177},"GreaterThanThreshold",[167,1033,202],{"class":195},[167,1035,1015],{"class":657},[167,1037,1038,1040,1043,1045,1047],{"class":169,"line":274},[167,1039,664],{"class":663},[167,1041,1042],{"class":667},"EvaluationPeriods",[167,1044,202],{"class":663},[167,1046,673],{"class":657},[167,1048,1049],{"class":257}," 3\n",[167,1051,1052],{"class":169,"line":285},[167,1053,1054],{"class":657},"}\n",[49,1056,1057,1058,1060,1061,1063,1064,1067],{},"Exactly one item in the ",[53,1059,668],{}," array sets ",[53,1062,798],{}," to ",[53,1065,1066],{},"true",", and that is the expression the alarm watches.",[49,1069,1070,1073],{},[339,1071,1072],{},"Anomaly detection alarms"," have no static threshold at all. CloudWatch trains a machine learning model on up to two weeks of the metric's past data, learning its hourly, daily, and weekly patterns plus its longer trend, and produces a band of expected values. The alarm then fires when the metric goes above the band, below it, or outside it in either direction.",[158,1075,1077],{"className":648,"code":1076,"language":650,"meta":163,"style":163},"{\n  \"Metrics\": [\n    { \"Id\": \"m1\", \"ReturnData\": true, \"MetricStat\": { \"Metric\": { \"Namespace\": \"AWS/EC2\", \"MetricName\": \"CPUUtilization\" }, \"Stat\": \"Average\", \"Period\": 60 } },\n    { \"Id\": \"t1\", \"Expression\": \"ANOMALY_DETECTION_BAND(m1, 3)\" }\n  ],\n  \"ThresholdMetricId\": \"t1\",\n  \"ComparisonOperator\": \"LessThanLowerOrGreaterThanUpperThreshold\",\n  \"EvaluationPeriods\": 2\n}\n",[53,1078,1079,1083,1095,1212,1250,1254,1273,1292,1305],{"__ignoreMap":163},[167,1080,1081],{"class":169,"line":170},[167,1082,658],{"class":657},[167,1084,1085,1087,1089,1091,1093],{"class":169,"line":188},[167,1086,664],{"class":663},[167,1088,668],{"class":667},[167,1090,202],{"class":663},[167,1092,673],{"class":657},[167,1094,676],{"class":657},[167,1096,1097,1099,1101,1103,1105,1107,1109,1112,1114,1116,1118,1120,1122,1124,1126,1128,1130,1132,1134,1136,1138,1140,1142,1144,1146,1148,1150,1152,1154,1156,1158,1161,1163,1165,1167,1169,1171,1173,1175,1177,1179,1181,1183,1185,1187,1189,1191,1193,1195,1197,1199,1201,1203,1205,1207,1210],{"class":169,"line":207},[167,1098,681],{"class":657},[167,1100,196],{"class":663},[167,1102,687],{"class":686},[167,1104,202],{"class":663},[167,1106,673],{"class":657},[167,1108,196],{"class":195},[167,1110,1111],{"class":177},"m1",[167,1113,202],{"class":195},[167,1115,701],{"class":657},[167,1117,196],{"class":663},[167,1119,798],{"class":686},[167,1121,202],{"class":663},[167,1123,673],{"class":657},[167,1125,972],{"class":663},[167,1127,701],{"class":657},[167,1129,196],{"class":663},[167,1131,707],{"class":686},[167,1133,202],{"class":663},[167,1135,673],{"class":657},[167,1137,714],{"class":657},[167,1139,196],{"class":663},[167,1141,719],{"class":257},[167,1143,202],{"class":663},[167,1145,673],{"class":657},[167,1147,714],{"class":657},[167,1149,196],{"class":663},[167,1151,731],{"class":730},[167,1153,202],{"class":663},[167,1155,673],{"class":657},[167,1157,196],{"class":195},[167,1159,1160],{"class":177},"AWS/EC2",[167,1162,202],{"class":195},[167,1164,701],{"class":657},[167,1166,196],{"class":663},[167,1168,749],{"class":730},[167,1170,202],{"class":663},[167,1172,673],{"class":657},[167,1174,196],{"class":195},[167,1176,55],{"class":177},[167,1178,202],{"class":195},[167,1180,763],{"class":657},[167,1182,196],{"class":663},[167,1184,780],{"class":257},[167,1186,202],{"class":663},[167,1188,673],{"class":657},[167,1190,196],{"class":195},[167,1192,155],{"class":177},[167,1194,202],{"class":195},[167,1196,701],{"class":657},[167,1198,196],{"class":663},[167,1200,112],{"class":257},[167,1202,202],{"class":663},[167,1204,673],{"class":657},[167,1206,258],{"class":257},[167,1208,1209],{"class":657}," }",[167,1211,808],{"class":657},[167,1213,1214,1216,1218,1220,1222,1224,1226,1229,1231,1233,1235,1237,1239,1241,1243,1246,1248],{"class":169,"line":218},[167,1215,681],{"class":657},[167,1217,196],{"class":663},[167,1219,687],{"class":686},[167,1221,202],{"class":663},[167,1223,673],{"class":657},[167,1225,196],{"class":195},[167,1227,1228],{"class":177},"t1",[167,1230,202],{"class":195},[167,1232,701],{"class":657},[167,1234,196],{"class":663},[167,1236,948],{"class":686},[167,1238,202],{"class":663},[167,1240,673],{"class":657},[167,1242,196],{"class":195},[167,1244,1245],{"class":177},"ANOMALY_DETECTION_BAND(m1, 3)",[167,1247,202],{"class":195},[167,1249,993],{"class":657},[167,1251,1252],{"class":169,"line":229},[167,1253,998],{"class":657},[167,1255,1256,1258,1261,1263,1265,1267,1269,1271],{"class":169,"line":240},[167,1257,664],{"class":663},[167,1259,1260],{"class":667},"ThresholdMetricId",[167,1262,202],{"class":663},[167,1264,673],{"class":657},[167,1266,196],{"class":195},[167,1268,1228],{"class":177},[167,1270,202],{"class":195},[167,1272,1015],{"class":657},[167,1274,1275,1277,1279,1281,1283,1285,1288,1290],{"class":169,"line":251},[167,1276,664],{"class":663},[167,1278,1022],{"class":667},[167,1280,202],{"class":663},[167,1282,673],{"class":657},[167,1284,196],{"class":195},[167,1286,1287],{"class":177},"LessThanLowerOrGreaterThanUpperThreshold",[167,1289,202],{"class":195},[167,1291,1015],{"class":657},[167,1293,1294,1296,1298,1300,1302],{"class":169,"line":263},[167,1295,664],{"class":663},[167,1297,1042],{"class":667},[167,1299,202],{"class":663},[167,1301,673],{"class":657},[167,1303,1304],{"class":257}," 2\n",[167,1306,1307],{"class":169,"line":274},[167,1308,1054],{"class":657},[49,1310,417,1311,1314],{},[53,1312,1313],{},"3"," is the anomaly detection threshold, and a higher number produces a thicker band and fewer alerts. Four details decide whether this is the right tool:",[333,1316,1317,1331,1334,1340],{},[336,1318,1319,1320,1323,1324,1326,1327,1330],{},"The model is specific to one metric ",[339,1321,1322],{},"and one statistic",". A model trained on ",[53,1325,155],{}," tells you nothing about ",[53,1328,1329],{},"Maximum",".",[336,1332,1333],{},"You can exclude time periods from training, which is how you stop last month's load test from teaching the model that a 10x spike is normal.",[336,1335,1336,1337,1330],{},"Alarms based on an anomaly detection model ",[339,1338,1339],{},"cannot have Auto Scaling actions",[336,1341,1342],{},"Each anomaly detection alarm bills as three standard-resolution alarm metrics (the metric plus the upper and lower bounds), so roughly $0.30 per month against $0.10 for a plain metric alarm.",[49,1344,1345],{},"Anomaly detection earns its place on metrics with a strong daily shape, such as request count on a consumer app. It is the wrong tool for a metric where any nonzero value is bad.",[65,1347,1349],{"id":1348},"diagnosing-an-alarm-that-will-not-leave-insufficient_data","Diagnosing an alarm that will not leave INSUFFICIENT_DATA",[49,1351,1352],{},"This is the single most common alarm ticket, and it has a short list of causes:",[333,1354,1355,1361,1367,1380],{},[336,1356,1357,1360],{},[339,1358,1359],{},"The period is shorter than the metric's resolution."," Basic EC2 monitoring publishes every 5 minutes, so a 60-second period leaves four out of five periods empty.",[336,1362,1363,1366],{},[339,1364,1365],{},"The dimension set was never published."," An alarm can be created before its custom metric exists, and it will happily sit in INSUFFICIENT_DATA forever if the dimensions do not match exactly what you publish.",[336,1368,1369,1376,1377,1379],{},[339,1370,1371,1372,1375],{},"A ",[53,1373,1374],{},"Unit"," was specified that the metric never uses."," AWS recommends omitting ",[53,1378,1374],{}," entirely, because a mismatch produces an alarm that is stuck rather than one that errors.",[336,1381,1382,1385],{},[339,1383,1384],{},"The resource is genuinely idle."," Detached EBS volumes, Lambda functions with no invocations, and Auto Scaling groups at zero instances all stop publishing.",[49,1387,1388,1389,1392,1393,1396],{},"Alarm history is kept for ",[339,1390,1391],{},"30 days",", and ",[53,1394,1395],{},"describe-alarm-history"," shows each state transition with its timestamp. That is your first stop when someone asks whether an alarm ever fired.",[158,1398,1400],{"className":160,"code":1399,"language":162,"meta":163,"style":163},"aws cloudwatch describe-alarm-history \\\n  --alarm-name \"checkout-api-cpu-high\" \\\n  --history-item-type StateUpdate \\\n  --max-records 10\n",[53,1401,1402,1413,1425,1435],{"__ignoreMap":163},[167,1403,1404,1406,1408,1411],{"class":169,"line":170},[167,1405,174],{"class":173},[167,1407,178],{"class":177},[167,1409,1410],{"class":177}," describe-alarm-history",[167,1412,185],{"class":184},[167,1414,1415,1417,1419,1421,1423],{"class":169,"line":188},[167,1416,192],{"class":191},[167,1418,196],{"class":195},[167,1420,199],{"class":177},[167,1422,202],{"class":195},[167,1424,185],{"class":184},[167,1426,1427,1430,1433],{"class":169,"line":207},[167,1428,1429],{"class":191},"  --history-item-type",[167,1431,1432],{"class":177}," StateUpdate",[167,1434,185],{"class":184},[167,1436,1437,1440],{"class":169,"line":218},[167,1438,1439],{"class":191},"  --max-records",[167,1441,1442],{"class":257}," 10\n",[65,1444,1446],{"id":1445},"exam-tips","Exam tips",[333,1448,1449,1452,1455,1467,1470,1473],{},[336,1450,1451],{},"\"The alarm stayed in ALARM but we only got one email\" is never a bug. Actions fire on state change. The only action re-invoked while the state holds is an Auto Scaling action, once per minute.",[336,1453,1454],{},"Read the wording of thresholds carefully. \"3 consecutive periods\" means M equals N; \"3 out of 5\" means M is 3 and N is 5, and the breaching points may be scattered.",[336,1456,1457,1458,1460,1461,1463,1464,1466],{},"Map the missing-data options to the metric's nature: a metric that only publishes on failure points at ",[53,1459,472],{},"; a continuously reported metric where silence is suspicious points at ",[53,1462,485],{},"; EC2 stop/terminate/reboot/recover alarms point at ",[53,1465,445],{},", which is also the global default.",[336,1468,1469],{},"A 10, 20, or 30 second period means a high-resolution alarm, and it only works on metrics stored at 1-second resolution. Question stems mentioning both a sub-minute period and an AWS-published metric are describing a broken alarm.",[336,1471,1472],{},"If a scenario says \"no fixed threshold works, the normal level changes by time of day\", the answer is anomaly detection, and remember it cannot drive Auto Scaling.",[336,1474,1475],{},"An alarm window longer than a day is evaluated hourly against data up to the top of the hour, and the total window caps at seven days.",[49,1477,1478],{},"The rule to carry forward: an alarm's state is decided by a sliding window of the last N data points, and everything that feels unpredictable about alarms comes from what CloudWatch does when that window has holes in it. Next you will follow the notification out of the alarm and into Amazon SNS, where a different set of quiet failures waits for you.",[1480,1481,1482],"style",{},"html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s39Yj, html code.shiki .s39Yj{--shiki-light:#39ADB5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sseR_, html code.shiki .sseR_{--shiki-light:#9C3EDA;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZMiF, html code.shiki .sZMiF{--shiki-light:#E2931D;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .swQdS, html code.shiki .swQdS{--shiki-light:#E53935;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":163,"searchDepth":207,"depth":207,"links":1484},[1485,1486,1487,1488,1489,1490,1491,1492,1493],{"id":67,"depth":188,"text":68},{"id":327,"depth":188,"text":328},{"id":379,"depth":188,"text":380},{"id":438,"depth":188,"text":439},{"id":548,"depth":188,"text":549},{"id":614,"depth":188,"text":615},{"id":635,"depth":188,"text":636},{"id":1348,"depth":188,"text":1349},{"id":1445,"depth":188,"text":1446},"md",[1496],{"slug":414,"concept":1497,"style":1498,"aspectRatio":1499,"labels":1500},"A single horizontal strip of five metric data points, newest on the right, showing how a 3-out-of-5 alarm reads its window. Each data point is drawn as a square marked breaching, within threshold, or missing, with a bracket above the strip labeling the evaluation periods (N) and a separate callout counting the breaching points needed (M). An arrow under the strip shows the window sliding one minute forward at each evaluation. The emphasis is that the breaching points are scattered rather than consecutive, and that the window moves.","diagram","16:9",[1501,1502,1503,1504,1505,1506,1507,1508,1509],"Period: 60 seconds, one data point per minute","Evaluation Periods (N): the 5 most recent data points","Datapoints to Alarm (M): 3 breaching points needed","Breaching","Within threshold","Missing","The window slides forward one minute at every evaluation","The 3 breaching points do not have to sit next to each other","M out of N trades a little detection speed for resistance to single-spike noise.",[37,38,39,40,41,42],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/01-monitoring-logging-performance/02-alarms-dashboards-and-notifications/01-cloudwatch-alarms-fundamentals",{"passingScore":1514,"questions":1515},70,[1516,1525,1533,1537,1545,1555,1561],{"question":1517,"type":1518,"options":1519,"correctAnswer":1521,"explanation":1524},"An alarm on OrderErrors has been in ALARM state for 40 minutes. The on-call engineer received exactly one SNS email, at the start. What explains this?","single",[1520,1521,1522,1523],"The SNS subscription silently unsubscribed after the first delivery","An alarm invokes its actions only when it changes state, not on every evaluation","SNS deduplicates identical messages for 40 minutes","The alarm entered INSUFFICIENT_DATA and stopped evaluating","CloudWatch fires alarm actions on the transition into a state, then stays quiet while the state holds. The one exception is an Auto Scaling action, which keeps being invoked once a minute for as long as the alarm stays in the new state. If you want repeated paging, that repetition has to come from your notification tool, not from CloudWatch.",{"question":1526,"type":1518,"options":1527,"correctAnswer":1530,"explanation":1532},"An alarm has Period 60, Evaluation Periods 5, and Datapoints to Alarm 3. The five most recent data points, oldest first, are: breaching, within threshold, breaching, within threshold, breaching. What is the alarm state?",[1528,1529,1530,1531],"OK, because the breaching points are not consecutive","INSUFFICIENT_DATA, because 2 points are below the threshold","ALARM, because 3 of the last 5 points are breaching","OK, because Datapoints to Alarm must equal Evaluation Periods","In an M out of N alarm the breaching data points do not have to be consecutive, they only have to fall inside the last N points. Three breaching points inside a window of five satisfies M=3, so the alarm goes to ALARM. The tempting wrong answer assumes consecutiveness, which is what you get only when M and N are equal.",{"question":1534,"type":1518,"options":1535,"correctAnswer":472,"explanation":1536},"Which missing-data treatment should you choose for an alarm on a metric that publishes a data point only when something goes wrong, such as ThrottledRequests?",[485,445,498,472],"For a metric that is silent when the system is healthy, silence is good news, so missing points should count as within the threshold. Choosing breaching would put the alarm in ALARM whenever nothing is wrong, and the default of missing would park it in INSUFFICIENT_DATA most of the time.",{"question":1538,"type":1518,"options":1539,"correctAnswer":1542,"explanation":1544},"An engineer creates an alarm with a period of 10 seconds on the EC2 CPUUtilization metric of an instance with detailed monitoring enabled. What is the most likely outcome?",[1540,1541,1542,1543],"The alarm works normally and reacts within 10 seconds","CloudWatch rejects the alarm because 10 is not a valid period","The alarm frequently lapses into INSUFFICIENT_DATA because the metric has no sub-minute data","CloudWatch automatically raises the period to 60 seconds","Periods of 10, 20, and 30 seconds are only valid in practice for metrics stored at 1-second resolution, which means custom metrics published with a storage resolution of 1. Detailed monitoring gets you one data point per minute, not per 10 seconds, so most 10-second periods contain nothing. The alarm is accepted and billed at the higher high-resolution rate while telling you nothing.",{"question":1546,"type":1547,"options":1548,"correctAnswers":1553,"explanation":1554},"Which statements about CloudWatch anomaly detection alarms are accurate? (Choose 2.)","multiple",[1549,1550,1551,1552],"The model trains on up to two weeks of the metric's past data","The band width is set by the number of standard deviations you pass to ANOMALY_DETECTION_BAND","An anomaly detection alarm can drive an Auto Scaling action","Anomaly detection replaces the need to choose a statistic, because the model covers all statistics",[1549,1550],"The model learns hourly, daily, and weekly patterns from up to two weeks of history, and the second argument to ANOMALY_DETECTION_BAND widens or narrows the expected range. Alarms based on an anomaly detection model cannot have Auto Scaling actions, and the model is built for one specific statistic, so a model trained on Average says nothing about Maximum.",{"question":1556,"type":1518,"options":1557,"correctAnswer":1558,"explanation":1560},"True or False: if some data points inside the evaluation range are missing but CloudWatch still retrieved at least Evaluation Periods worth of real data points, the missing-data setting is ignored.",[1558,1559],"True","False","CloudWatch retrieves a wider evaluation range than the window you configured, precisely so it can reach back for older real data points when recent ones are missing. It substitutes the missing-data treatment only when real points are still too few, which is why an alarm with intermittent gaps often behaves exactly the same no matter which treatment you picked.",{"question":1562,"type":1518,"options":1563,"correctAnswer":1566,"explanation":1568},"An alarm on a batch job uses Period 3600 and Evaluation Periods 72, so it spans three days. The job fails at 10:02 and the alarm does not change state at 10:03. Why?",[1564,1565,1566,1567],"Alarms cannot span more than 24 hours","The alarm needs three full days of data before it evaluates at all","Multi-day alarms are evaluated once per hour and consider only data up to the top of the hour","The failure produced no data point, so the alarm is in INSUFFICIENT_DATA","When Period multiplied by Evaluation Periods exceeds one day, CloudWatch drops to hourly evaluation and takes into account only metrics up to the current hour at the :00 minute. The failure at 10:02 is invisible to the 10:03 evaluation and is picked up at 11:03. Alarms with a period of at least one hour can span at most seven days in total.",{"title":34,"description":35},"courses/aws-certified-cloudops-engineer-associate/en/domains/01-monitoring-logging-performance/02-alarms-dashboards-and-notifications/01-cloudwatch-alarms-fundamentals","s16DF7PMUcezMV70Oj__cHPrQsPZ66z-DEFEg1iP_Xk"]