Combining alarms in the AWS cloud – Composite Alarm

Hi, in this article you will find a lot of information about alarms, notifications and similar things in the AWS cloud. You probably know that the CloudWatch service, which is an integral part of AWS, allows you to collect and monitor metrics and logs from various services and resources in the AWS cloud.

One of the most powerful features available in CloudWatch is the ability to create composite alarms. Alarms composed of many other alarms that can be combined into one logical expression. This allows users to define advanced monitoring rules tailored to the specific needs of their infrastructure and applications.

When you create a composite alarm in AWS CloudWatch, you have access to various logical operators that enable you to define more complex monitoring conditions. Here are some examples:

1. AND: This logical operator activates a composite alarm when all defined alarms inside it are active. For example: ALARM(CPUUtilizationTooHigh) AND ALARM(RAMUtilizationTooHigh).
2. OR: The OR operator activates a composite alarm when at least one of the defined alarms inside it is active. For example: ALARM(CPUUtilizationTooHigh) AND ALARM(RAMUtilizationTooHigh).
3. NOT: The NOT operator allows you to define negation, activating a composite alarm when the specified alarm is not active. For example: ALARM(CPUTooHigh) AND NOT ALARM(DeploymentInProgress).
4. You can also combine alarms into something more complex, for example:

 (ALARM(ResponseTimeTooHigh) OR ALARM(ErrorRateTooHigh)) AND ALARM(ServerBusy)

In this case, a composite alarm can be activated when the response from the server is too long ResponseTimeTooHigh or the error rate ErrorRateTooHigh exceeds a certain threshold and at the same time the server is busy with ServerBusy.

(ALARM(CPUUtilizationTooHigh) OR ALARM(RAMUtilizationTooHigh)) AND NOT ALARM(DeploymentInProgress)

In this case, the expression specifies that a composite alarm can be activated if CPUUtilizationTooHigh or RAMUtilizationTooHigh is in the ALARM state and DeploymentInProgress is not in the ALARM state. This is an example of a composite alarm that reduces noise, for example during updates in the maintenance window.

(ALARM(CPUUtilizationTooHigh) OR ALARM(RAMUtilizationTooHigh)) AND OK(NetworkOutTooHigh)

By the way, you don’t always have to use ALARM, sometimes you can use OK. The above expression specifies that a composite alarm goes to the ALARM state if either CPUUtilizationTooHigh or RAMUtilizationTooHigh is in the ALARM state and NetworkOutTooHigh is OK. This is also an example of a composite alarm that reduces the noise of unnecessary alarms.

Summary

Composite alarms in AWS CloudWatch are a powerful tool that allows you to create advanced monitoring rules that take into account many different factors at the same time. Thanks to them, users can effectively manage the monitoring of their infrastructure and applications in the AWS cloud, minimizing false positives and focusing on important problems. If you don’t have a separate monitoring and notification system, it’s definitely worth taking a look at what AWS offers.

I encourage you to visit my YouTube channel, there you will find a video describing this topic and you will see what it looks like to create composite alarms in a real cloud environment AWS Composite Alarm | CloudWatch 2024 (youtube.com). If you are interested in creating alarms based on metrics, you may be interested in the video How to create an alarm based on metrics? | AWS EC2 | CloudWatch Hands-On Tutorial (youtube.com).

Alarm based on metrics from CloudWatch | EC2 Disk Usage Notifications

Notifications from AWS on MS Teams