AWS AmazonCloudWatch documentation change
Summary
Complete rewrite of the document from conceptual explanation of composite alarms to a step-by-step guide for creating composite alarms in the CloudWatch console. Removed theoretical content about alarm combinations and added procedural instructions.
Security assessment
The changes are purely instructional, focusing on console navigation and alarm creation steps. No security vulnerabilities, patches, or security-specific features are mentioned. The content shift is from conceptual to operational guidance without security implications.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.md b/AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.md index 66fd985e0..481abd2b4 100644 --- a//AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.md +++ b//AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.md @@ -5 +5 @@ -Muting Composite Alarm Actions +# Create a composite alarm @@ -7 +7 @@ Muting Composite Alarm Actions -# Combining alarms +The steps in this section explain how to use the CloudWatch console to create a composite alarm. You can also use the API or AWS CLI to create a composite alarm. For more information, see [PutCompositeAlarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutCompositeAlarm.html) or [put-composite-alarm](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudwatch/put-composite-alarm.html) @@ -9 +9 @@ Muting Composite Alarm Actions -With CloudWatch, you can combine several alarms into one _composite alarm_ to create a summarized, aggregated health indicator over a whole application or group of resources. Composite alarms are alarms that determine their state by monitoring the states of other alarms. You define rules to combine the status of those monitored alarms using Boolean logic. +###### To create a composite alarm @@ -11,49 +11 @@ With CloudWatch, you can combine several alarms into one _composite alarm_ to cr -You can use composite alarms to reduce alarm noise by taking actions only at an aggregated level. For example, you can create a composite alarm to send a notification to your web server team if any alarm related to your web server triggers. When any of those alarms goes into the ALARM state, the composite alarm goes itself in the ALARM state and sends a notification to your team. If other alarms related to your web server also go into the ALARM state, your team does not get overloaded with new notifications since the composite alarm has already notified them about the existing situation. - -You can also use composite alarms to create complex alarming conditions and take actions only when many different conditions are met. For example, you can create a composite alarm that combines a CPU alarm and a memory alarm, and would only notify your team if both the CPU and the memory alarms have triggered. - -**Using composite alarms** - -When you use composite alarms, you have two options: - - * Configure the actions you want to take only at the composite alarm level, and create the underlying monitored alarms without actions - - * Configure a different set of actions at the composite alarm level. For example, the composite alarm actions could engage a different team in case of a widespread issue. - - - - -Composite alarms can take only the following actions: - - * Notify Amazon SNS topics - - * Invoke Lambda functions - - * Create OpsItems in Systems Manager Ops Center - - * Create incidents in Systems Manager Incident Manager - - - - -###### Note - -All the underlying alarms in your composite alarm must be in the same account and the same Region as your composite alarm. However, if you set up a composite alarm in a CloudWatch cross-account observability monitoring account, the underlying alarms can watch metrics in different source accounts and in the monitoring account itself. For more information, see [CloudWatch cross-account observability](./CloudWatch-Unified-Cross-Account.html). - -A single composite alarm can monitor 100 underlying alarms, and 150 composite alarms can monitor a single underlying alarm. - -**Rule expressions** - -All composite alarms contain rule expressions. Rule expressions tell composite alarms which other alarms to monitor and determine their states from. Rule expressions can refer to metric alarms and composite alarms. When you reference an alarm in a rule expression, you designate a function to the alarm that determines which of the following three states the alarm will be in: - - * ALARM - -ALARM ("alarm-name or alarm-ARN") is TRUE if the alarm is in ALARM state. - - * OK - -OK ("alarm-name or alarm-ARN") is TRUE if the alarm is in OK state. - - * INSUFFICIENT_DATA - -INSUFFICIENT_DATA (“alarm-name or alarm-ARN") is TRUE if the named alarm is in INSUFFICIENT_DATA state. + 1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). @@ -60,0 +13 @@ INSUFFICIENT_DATA (“alarm-name or alarm-ARN") is TRUE if the named alarm is in + 2. In the navigation pane, choose **Alarms** , and then choose **All alarms**. @@ -61,0 +15 @@ INSUFFICIENT_DATA (“alarm-name or alarm-ARN") is TRUE if the named alarm is in + 3. From the list of alarms, select the check box next to each of the existing alarms that you want to reference in your rule expression, and then choose **Create composite alarm**. @@ -62,0 +17 @@ INSUFFICIENT_DATA (“alarm-name or alarm-ARN") is TRUE if the named alarm is in + 4. Under **Specify composite alarm conditions** , specify the rule expression for your new composite alarm. @@ -66,9 +21 @@ INSUFFICIENT_DATA (“alarm-name or alarm-ARN") is TRUE if the named alarm is in -TRUE always evaluates to TRUE, and FALSE always evaluates to FALSE. - -**Alarm references** - -When referencing an alarm, using either the alarm name or ARN, the rule syntax can support referencing the alarm with or without quotation marks (") around the alarm name or ARN. - - * If specified without quotes, alarm names or ARNs must not contain spaces, round brackets, or commas. - - * If specified within quotes, alarm names or ARNs that _include_ double quotes (") must enclose the " using backslash escape (\\) characters for correct interpretation of the reference. +Automatically, the alarms that you selected from the list of alarms are listed in the **Conditions** box. By default, the `ALARM` function has been designated to each of your alarms, and each of your alarms is joined by the logical operator `OR`. @@ -75,0 +23 @@ When referencing an alarm, using either the alarm name or ARN, the rule syntax c +You can use the following substeps to modify your rule expression: @@ -76,0 +25 @@ When referencing an alarm, using either the alarm name or ARN, the rule syntax c + 1. You can change the required state for each of your alarms from `ALARM` to `OK` or `INSUFFICIENT_DATA`. @@ -77,0 +27 @@ When referencing an alarm, using either the alarm name or ARN, the rule syntax c + 2. You can change the logical operator in your rule expression from `OR` to `AND` or `NOT`, and you can add parentheses to group your functions. @@ -79 +29 @@ When referencing an alarm, using either the alarm name or ARN, the rule syntax c -**Syntax** + 3. You can include other alarms in your rule expression or delete alarms from your rule expression. @@ -81 +31 @@ When referencing an alarm, using either the alarm name or ARN, the rule syntax c -The syntax of the expression you use to combine several alarms into one composite alarm uses boolean logic and functions. The following table describes the operators and functions available in rule expressions: +**Example: Rule expression with conditions** @@ -83,6 +33,3 @@ The syntax of the expression you use to combine several alarms into one composit -Operator/Function | Description ----|--- -`AND` | Logical AND operator. Returns TRUE when all specified conditions are TRUE. -`OR` | Logical OR operator. Returns TRUE when at least one of the specified conditions is TRUE. -`NOT` | Logical NOT operator. Returns TRUE when the specified condition is FALSE. -`AT_LEAST` | Function that returns TRUE when a minimum number or percentage of specified alarms are in the required state. Format: `AT_LEAST(M, STATE_CONDITION, (alarm1, alarm2, ...alarmN))` where M can be an absolute number or percentage (for example, 50%), and STATE_CONDITION can be ALARM, OK, INSUFFICIENT_DATA, NOT ALARM, NOT OK, or NOT INSUFFICIENT_DATA. + (ALARM("CPUUtilizationTooHigh") OR + ALARM("DiskReadOpsTooHigh")) AND + OK("NetworkOutTooHigh") @@ -90 +37 @@ Operator/Function | Description -You can use parentheses to group conditions and control the order of evaluation in complex expressions. +In the example rule expression where the composite alarm goes into `ALARM` when ALARM ("CPUUtilizationTooHigh" or ALARM("DiskReadOpsTooHigh") is in `ALARM` at the same time as OK("NetworkOutTooHigh") is in `OK`. @@ -92 +39 @@ You can use parentheses to group conditions and control the order of evaluation -**Example expressions** + 5. When finished, choose **Next**. @@ -94 +41 @@ You can use parentheses to group conditions and control the order of evaluation -The request parameter `AlarmRule` supports the use of the logical operators `AND`, `OR`, and `NOT`, as well as the `AT_LEAST` function, so you can combine multiple functions into a single expressions. The following example expressions show how you can configure the underlying alarms in your composite alarm: + 6. Under **Configure actions** , you can choose from the following: @@ -96 +43 @@ The request parameter `AlarmRule` supports the use of the logical operators `AND - * `ALARM(CPUUtilizationTooHigh) AND ALARM(DiskReadOpsTooHigh)` +For **_Notification_** @@ -98 +45 @@ The request parameter `AlarmRule` supports the use of the logical operators `AND -The expression specifies that the composite alarm goes into `ALARM` only if `CPUUtilizationTooHigh` and `DiskReadOpsTooHigh` are in `ALARM`. + * **Select an exisiting SNS topic** , **Create a new SNS topic** , or **Use a topic ARN** to define the SNS topic that will receive the notification. @@ -100 +47 @@ The expression specifies that the composite alarm goes into `ALARM` only if `CPU - * `AT_LEAST(2, ALARM, (WebServer1CPU, WebServer2CPU, WebServer3CPU, WebServer4CPU))` + * **Add notification** , so your alarm can send multiple notifications for the same alarm state or different alarm states. @@ -102 +49 @@ The expression specifies that the composite alarm goes into `ALARM` only if `CPU -The expression specifies that the composite alarm goes into `ALARM` when at least 2 out of the 4 web server CPU alarms are in `ALARM` state. This allows you to trigger alerts based on a threshold of affected resources rather than requiring all or just one to be in alarm state. + * **Remove** to stop your alarm from sending notifications or taking actions. @@ -104 +51 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas - * `AT_LEAST(50%, OK, (DatabaseConnection1, DatabaseConnection2, DatabaseConnection3, DatabaseConnection4))` +(Optional) To have the alarm invoke a Lambda function when it changes state, choose **Add Lambda action**. Then specify the function name or ARN, and optionally choose a specific version of the function. @@ -106 +53 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas -The expression specifies that the composite alarm goes into `ALARM` when at least 50% of the database connection alarms are in `OK` state. Using percentages allows the rule to adapt dynamically as you add or remove monitored alarms. +For **_Systems Manager action_** @@ -108 +55 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas - * `ALARM(CPUUtilizationTooHigh) AND NOT ALARM(DeploymentInProgress)` + * **Add Systems Manager action** , so your alarm can perform an SSM action when it goes into ALARM. @@ -110 +57 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas -The expression specifies that the composite alarm goes into `ALARM` if `CPUUtilizationTooHigh` is in `ALARM` and `DeploymentInProgress` is not in `ALARM`. This is an example of a composite alarm that reduces alarm noise during a deployment window. +To learn more about Systems Manager actions, see [Configuring CloudWatch to create OpsItems from alarms](https://docs.aws.amazon.com/systems-manager/latest/userguide/OpsCenter-create-OpsItems-from-CloudWatch-Alarms.html) in the _AWS Systems Manager User Guide_ and [Incident creation](https://docs.aws.amazon.com/incident-manager/latest/userguide/incident-creation.html) in the _Incident Manager User Guide_. To create an alarm that performs an SSM Incident Manager action, you must have the correct permissions. For more information, see [Identity-based policy examples for AWS Systems Manager Incident Manager](https://docs.aws.amazon.com/incident-manager/latest/userguide/security_iam_id-based-policy-examples.html) in the _Incident Manager User Guide_. @@ -112 +59 @@ The expression specifies that the composite alarm goes into `ALARM` if `CPUUtili - * `AT_LEAST(2, ALARM, (AZ1Health, AZ2Health, AZ3Health)) AND NOT ALARM(MaintenanceWindow)` +To have the alarm start an investigation, choose **Add investigation action** and then select your investigation group. For more information about , see [CloudWatch investigations](./Investigations.html). @@ -114 +61 @@ The expression specifies that the composite alarm goes into `ALARM` if `CPUUtili -The expression specifies that the composite alarm goes into `ALARM` when at least 2 out of 3 availability zone health alarms are in `ALARM` state and the maintenance window alarm is not in `ALARM`. This combines the AT_LEAST function with other logical operators for more complex monitoring scenarios. + 7. When finished, choose **Next**. @@ -115,0 +63 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas + 8. Under **Add name and description** , enter an alarm name and _optional_ description for your new composite alarm. The name must contain only UTF-8 characters, and can't contain ASCII control characters. The description can include markdown formatting, which is displayed only in the alarm **Details** tab in the CloudWatch console. The markdown can be useful to add links to runbooks or other internal resources. @@ -116,0 +65 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas + 9. When finished, choose **Next**. @@ -117,0 +67 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas + 10. Under **Preview and create** , confirm your information, and then choose **Create composite alarm**. @@ -119,7 +69 @@ The expression specifies that the composite alarm goes into `ALARM` when at leas -## Muting Composite Alarm Actions - -Alarm mute rules allow you to automatically mute composite alarm actions during predefined time windows, such as maintenance periods or operational events. CloudWatch continues monitoring alarm states while preventing unwanted notifications. For more information, see [Alarm Mute Rules](./alarm-mute-rules.html). - -###### Topics - - * [Create a composite alarm](./Create_Composite_Alarm_How_To.html) +###### Note @@ -127 +71 @@ Alarm mute rules allow you to automatically mute composite alarm actions during - * [ Suppressing composite alarm actions ](./Create_Composite_Alarm_Suppression.html) +You can create a cycle of composite alarms, where one composite alarm and another composite alarm depend on each other. If you find yourself in this scenario, your composite alarms stop being evaluated, and you can't delete your composite alarms because they're dependent on each other. The easiest way to break the cycle of dependecy between your composite alarms is to change the function `AlarmRule` in one of your composite alarms to `False`. @@ -140 +84 @@ Alarming on logs -Create a composite alarm +Acting on alarm changes