CloudWatch alarm considers missing data points before alarm creation

0

I observed that when my cloud watch alarm is configured to treat missing data as breaching. The cloud watch alarm created at time T considers missing data points before T and alarms. Shouldn't cloud watch alarm only considers data points after the alarm's creation time?

In my case, the alarm was deleted and re-created, I don't know if this is a corner case which triggers the behavior that I saw.

Here are the alarm histories:

  • 2023-11-11 07:42:49 Alarm "request_data_from_endpoint_Errors_Sum" created
  • 2023-11-11 07:43:42 Alarm updated from Insufficient data to In alarm. Details are below. Please notice that it considers the missing data points between 7:33 and 7:42.
{
  "alarmName": "request_data_from_endpoint_Errors_Sum",
  "alarmType": "MetricAlarm",
  "timestamp": "2023-11-11T07:43:42.851Z",
  "historyItemType": "StateUpdate",
  "historySummary": "Alarm updated from INSUFFICIENT_DATA to ALARM",
  "historyData": {
    "version": "1.0",
    "oldState": {
      "stateValue": "INSUFFICIENT_DATA",
      "stateReason": "Unchecked: Initial alarm creation"
    },
    "newState": {
      "stateValue": "ALARM",
      "stateReason": "Threshold Crossed: no datapoints were received for 10 periods and 10 missing datapoints were treated as [Breaching].",
      "stateReasonData": {
        "version": "1.0",
        "queryDate": "2023-11-11T07:43:42.846+0000",
        "statistic": "Sum",
        "period": 60,
        "recentDatapoints": [],
        "threshold": 0,
        "evaluatedDatapoints": [
          {
            "timestamp": "2023-11-11T07:42:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:41:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:40:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:39:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:38:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:37:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:36:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:35:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:34:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:33:00.000+0000"
          }
        ]
      }
    }
  }
}
AWS
amznzl
demandé il y a 6 mois658 vues
1 réponse
0
Réponse acceptée

Hi,

Not sure if it explains the behaviour, but found this Note:

If data points are missing soon after you create an alarm, 
and the metric was being reported to CloudWatch before 
you created the alarm, CloudWatch retrieves the most recent 
data points from before the alarm was created when evaluating 
the alarm.

here https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarm-evaluation

profile picture
EXPERT
répondu il y a 6 mois
profile picture
EXPERT
vérifié il y a 2 mois

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions