Hedronite · Cert Lesson · Cert-Prep / AWS · Thu 2026-09-10

AWS DOP CloudWatch and X-Ray — alarms, metric filters, sampling

Metrics without alarms are history. Alarms without actions are theater.

Lesson Class: Cert-Prep (AWS DOP-C02 monitoring)

Bootcamp: MonitoringLogging.md + DOP-C02 notes

Alarm

Needs actions.

Filter

Logs to metrics.

X-Ray

Sample wisely.

Actionable beats silent.

Metrics without alarms are history. Alarms without actions are theater.

§I — Frame

DOP monitoring domain: CloudWatch metrics retention tiers, alarms (including EC2 recover actions), metric filters on Logs, Logs subscriptions, and X-Ray daemon/sampling for request traces. Rebalance away from EventBridge (08-29) and pipeline SDLC (08-05).

§II — Objective map

Need	Mechanism
Alert on threshold	CloudWatch Alarm + actions (SNS / ASG / EC2 recover)
Turn log lines into metrics	Metric filter on a log group
Stream logs onward	Logs subscription to Kinesis / ES / Lambda
Trace requests	X-Ray SDK + daemon (UDP 2000); sampling rules
Memory metrics on EC2	CloudWatch agent (not default)

§III — Exam discriminators

Metric filters create metrics from logs; they are not alarms by themselves.
Composite alarms combine child alarms with boolean logic.
X-Ray sampling reduces cost; 100% sampling is rarely the production default.
EC2 memory is custom unless the agent publishes it.
EventBridge vs alarm actions: alarms act on metric state; EventBridge routes events. Do not conflate on vignettes (08-29 already spent buses).

§IV — Study drill

From MonitoringLogging.md: redraw retention tiers (1s/1m/5m/1h). Name three alarm action targets. Sketch a metric filter → alarm → SNS path. Note X-Ray daemon port.

§V — Dual-corpus

09-Tomes has no AWS shelf by design (empty-by-scope). Bootcamp hits are the correct DOP verdict.

§VI — Closing

Actionable alarms beat silent dashboards. Sampling keeps X-Ray affordable.