CloudWatch alarm considers missing data points before alarm creation

0

I observed that when my cloud watch alarm is configured to treat missing data as breaching. The cloud watch alarm created at time T considers missing data points before T and alarms. Shouldn't cloud watch alarm only considers data points after the alarm's creation time?

In my case, the alarm was deleted and re-created, I don't know if this is a corner case which triggers the behavior that I saw.

Here are the alarm histories:

  • 2023-11-11 07:42:49 Alarm "request_data_from_endpoint_Errors_Sum" created
  • 2023-11-11 07:43:42 Alarm updated from Insufficient data to In alarm. Details are below. Please notice that it considers the missing data points between 7:33 and 7:42.
{
  "alarmName": "request_data_from_endpoint_Errors_Sum",
  "alarmType": "MetricAlarm",
  "timestamp": "2023-11-11T07:43:42.851Z",
  "historyItemType": "StateUpdate",
  "historySummary": "Alarm updated from INSUFFICIENT_DATA to ALARM",
  "historyData": {
    "version": "1.0",
    "oldState": {
      "stateValue": "INSUFFICIENT_DATA",
      "stateReason": "Unchecked: Initial alarm creation"
    },
    "newState": {
      "stateValue": "ALARM",
      "stateReason": "Threshold Crossed: no datapoints were received for 10 periods and 10 missing datapoints were treated as [Breaching].",
      "stateReasonData": {
        "version": "1.0",
        "queryDate": "2023-11-11T07:43:42.846+0000",
        "statistic": "Sum",
        "period": 60,
        "recentDatapoints": [],
        "threshold": 0,
        "evaluatedDatapoints": [
          {
            "timestamp": "2023-11-11T07:42:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:41:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:40:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:39:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:38:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:37:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:36:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:35:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:34:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:33:00.000+0000"
          }
        ]
      }
    }
  }
}
AWS
amznzl
asked 6 months ago642 views
1 Answer
0
Accepted Answer

Hi,

Not sure if it explains the behaviour, but found this Note:

If data points are missing soon after you create an alarm, 
and the metric was being reported to CloudWatch before 
you created the alarm, CloudWatch retrieves the most recent 
data points from before the alarm was created when evaluating 
the alarm.

here https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarm-evaluation

profile picture
EXPERT
answered 6 months ago
profile picture
EXPERT
reviewed a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions