CloudWatch alarm considers missing data points before alarm creation

0

I observed that when my cloud watch alarm is configured to treat missing data as breaching. The cloud watch alarm created at time T considers missing data points before T and alarms. Shouldn't cloud watch alarm only considers data points after the alarm's creation time?

In my case, the alarm was deleted and re-created, I don't know if this is a corner case which triggers the behavior that I saw.

Here are the alarm histories:

  • 2023-11-11 07:42:49 Alarm "request_data_from_endpoint_Errors_Sum" created
  • 2023-11-11 07:43:42 Alarm updated from Insufficient data to In alarm. Details are below. Please notice that it considers the missing data points between 7:33 and 7:42.
{
  "alarmName": "request_data_from_endpoint_Errors_Sum",
  "alarmType": "MetricAlarm",
  "timestamp": "2023-11-11T07:43:42.851Z",
  "historyItemType": "StateUpdate",
  "historySummary": "Alarm updated from INSUFFICIENT_DATA to ALARM",
  "historyData": {
    "version": "1.0",
    "oldState": {
      "stateValue": "INSUFFICIENT_DATA",
      "stateReason": "Unchecked: Initial alarm creation"
    },
    "newState": {
      "stateValue": "ALARM",
      "stateReason": "Threshold Crossed: no datapoints were received for 10 periods and 10 missing datapoints were treated as [Breaching].",
      "stateReasonData": {
        "version": "1.0",
        "queryDate": "2023-11-11T07:43:42.846+0000",
        "statistic": "Sum",
        "period": 60,
        "recentDatapoints": [],
        "threshold": 0,
        "evaluatedDatapoints": [
          {
            "timestamp": "2023-11-11T07:42:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:41:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:40:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:39:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:38:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:37:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:36:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:35:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:34:00.000+0000"
          },
          {
            "timestamp": "2023-11-11T07:33:00.000+0000"
          }
        ]
      }
    }
  }
}
AWS
amznzl
已提問 6 個月前檢視次數 658 次
1 個回答
0
已接受的答案

Hi,

Not sure if it explains the behaviour, but found this Note:

If data points are missing soon after you create an alarm, 
and the metric was being reported to CloudWatch before 
you created the alarm, CloudWatch retrieves the most recent 
data points from before the alarm was created when evaluating 
the alarm.

here https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarm-evaluation

profile picture
專家
已回答 6 個月前
profile picture
專家
已審閱 2 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南