CloudWatch alarm considers missing data points before alarm creation

0

I observed that when my cloud watch alarm is configured to treat missing data as breaching. The cloud watch alarm created at time T considers missing data points before T and alarms. Shouldn't cloud watch alarm only considers data points after the alarm's creation time?

In my case, the alarm was deleted and re-created, I don't know if this is a corner case which triggers the behavior that I saw.

Here are the alarm histories:

  • 2023-11-11 07:42:49 Alarm "request_data_from_endpoint_Errors_Sum" created
  • 2023-11-11 07:43:42 Alarm updated from Insufficient data to In alarm. Details are below. Please notice that it considers the missing data points between 7:33 and 7:42.
{
  "alarmName": "request_data_from_endpoint_Errors_Sum",
  "alarmType": "MetricAlarm",
  "timestamp": "2023-11-11T07:43:42.851Z",
  "historyItemType": "StateUpdate",
  "historySummary": "Alarm updated from INSUFFICIENT_DATA to ALARM",
  "historyData": {
    "version": "1.0",
    "oldState": {
      "stateValue": "INSUFFICIENT_DATA",
      "stateReason": "Unchecked: Initial alarm creation"
    },
    "newState": {
      "stateValue": "ALARM",
      "stateReason": "Threshold Crossed: no datapoints were received for 10 periods and 10 missing datapoints were treated as [Breaching].",
      "stateReasonData": {
        "version": "1.0",
        "queryDate": "2023-11-11T07:43:42.846+0000",
        "statistic": "Sum",
        "period": 60,
        "recentDatapoints": [],
        "threshold": 0,
        "evaluatedDatapoints": [
          {
            "timestamp": "2023-11-11T07:42:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:41:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:40:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:39:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:38:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:37:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:36:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:35:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:34:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:33:00.000+0000"
          }
        ]
      }
    }
  }
}
AWS
amznzl
질문됨 6달 전658회 조회
1개 답변
0
수락된 답변

Hi,

Not sure if it explains the behaviour, but found this Note:

If data points are missing soon after you create an alarm, 
and the metric was being reported to CloudWatch before 
you created the alarm, CloudWatch retrieves the most recent 
data points from before the alarm was created when evaluating 
the alarm.

here https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarm-evaluation

profile picture
전문가
답변함 6달 전
profile picture
전문가
검토됨 2달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인