Skip to content
BytePatterns

CloudWatch, Alarms & X-Ray

AWS for Interviews: lesson 10 of 18

Metrics say that, traces say where, logs say why.

Lesson 10 of 18 · 6 min

CloudWatch, Alarms & X-Ray

Step 1 of 11

Every incident asks three things in order: is it broken, where, and why. Each has its own tool.

The Idea

CloudWatch metrics are numbers per period, named by namespace and dimensions. An alarm compares a metric with a threshold over several periods and moves between OK, ALARM and INSUFFICIENT_DATA; its actions can notify SNS or scale a group. CloudWatch Logs holds log groups you query with Logs Insights. X-Ray follows one request across services as a trace of segments.

Real-World Example

After a bad deploy, the load balancer's 5XX count breaches for three periods and the alarm pages on-call through SNS. A trace shows the time disappearing into a database call; a Logs Insights query finds "pool exhausted".

The Tradeoff

Alarm on symptoms users feel — errors, latency — or pages become noise. X-Ray's SDKs and daemon entered maintenance mode in February 2026; AWS recommends OpenTelemetry for new instrumentation. CloudTrail, not CloudWatch, records who called which API.

Hands-On

# illustrative — load balancer name and topic ARN are placeholders
aws cloudwatch put-metric-alarm --alarm-name api-5xx \
  --namespace AWS/ApplicationELB --metric-name HTTPCode_Target_5XX_Count \
  --dimensions Name=LoadBalancer,Value=app/web/1234567890abcdef \
  --statistic Sum --period 60 --evaluation-periods 3 --threshold 10 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:oncall

Your turn

Put the steps in the right order.

  1. A trace shows which service the time went to
  2. The alarm moves to ALARM and notifies SNS
  3. The 5XX metric breaches its threshold for several periods
  4. A log query finds the error behind it

Mini quiz

1 / 3

An alarm with 3 evaluation periods moves to ALARM when:

Sources

New lessons land every few weeks

Leave an address and we will tell you when the next one is up. That is the only reason we will use it.

One address, stored so we can email you. Nothing else, ever.