Monitoring, Logging, and Remediation
SysOps administrators keep workloads healthy by collecting metrics and logs, alarming on problems, and remediating automatically. This domain centers on Amazon CloudWatch, AWS CloudTrail, and event-driven remediation.
CloudWatch metrics and alarms
CloudWatch collects metrics from AWS services at a standard resolution and custom metrics you publish. Alarms evaluate a metric against a threshold over a number of periods and change state to trigger actions such as SNS notifications or Auto Scaling. Basic EC2 monitoring reports every five minutes; enabling detailed monitoring reports every minute. Memory and disk usage are not collected by default and require the CloudWatch agent.
Centralized logging
The CloudWatch agent ships operating-system and application logs to CloudWatch Logs, where log groups organize streams and retention is set per group. CloudWatch Logs Insights queries logs at scale, and metric filters turn log patterns into metrics you can alarm on. Export or subscribe logs to other destinations when long-term analysis is needed.
Auditing with CloudTrail
AWS CloudTrail records API calls across the account for governance and security investigation. A multi-Region trail delivering to an S3 bucket captures management events everywhere, and log file validation detects tampering. CloudTrail answers who did what and when, whereas CloudWatch focuses on operational metrics and logs.
Automated remediation
Amazon EventBridge rules react to events (for example a state change) and invoke targets such as Lambda or Systems Manager Automation runbooks to fix issues without human intervention. AWS Config rules detect noncompliant resources and can trigger remediation. Automating routine fixes reduces mean time to recovery.