Alarms on Anomaly Detection band

You can create an alarm based on CloudWatch anomaly detection, which mines past metric data and creates a model of expected values. The expected values take into account the typical hourly, daily, and weekly patterns in the metric.

You set a value for the anomaly detection threshold, and CloudWatch uses this threshold with the model to determine the “normal” range of values for the metric. A higher value for the threshold produces a thicker band of “normal” values.

You can choose whether the alarm is triggered when the metric value is above the band of expected values, below the band, or either above or below the band.

Learn more about Anomaly Detection here.

Create an Alarm based on Anomaly Detection band

  1. In the AWS Management Console on the Services menu, click CloudWatch.
  2. In the left navigation menu, click on Metrics.

This will take you to the Metrics home page, where you will see all the Namespaces available in the account.

  1. Select ContainerInsights or ECS/ContainerInsights namespace.

Alarms

Inside the Namespace, you will see all the dimensions under which the metrics are aggregated under

  1. Select ClusterName dimension and select one of the CPU Utilization metrics.

If you see pod_memory_utilization, select that one.

Your screen should look similar to the one below.

Alarms7

  1. Go to Graphed Metrics tab.
  2. Select the Anomaly Detection button from the Actions column as shown below.

Alarms7

Get a deep dive experience on Anomaly Detection in the workshop module here.

Your screen should look like the one below with the Anomaly Detection band immediately created. Alarms7

  1. In the Actions column, click on the create alarm button (🔔).

This should take you to a screen similar to the one below.

Alarms10

Notice that the Anomaly detection option is selected. Under Whenever pod_memory_utilization is... you can select any of the 3 options presented there.

  1. Select Outside of the band.

You can also select the standard deviation value under Anomaly detection threshold section. Change the value to see that the band around the metric timeline changing dynamically.

  1. Expand Additional configuration, where you can indicate how many occurences of the breach qualifies for the alarm to be triggered.
  2. Set the values to 2 out of 5.

This will make the alarm get triggered if there has been 2 breaches in 5 evaluation periods. Notice the message at the top of the graph describing the setting as This alarm will trigger when the blue line goes above the red line for 2 datapoints within 25 minutes.

  1. Click Next.

  • In the Configure actions screen, you can set what action you want to take when the alarm changes to different states such as

    • In alarm
    • OK
    • Insufficient data

  • The available options for actions include,

    • Send a notification to an SNS topic
    • Take an Auto scaling action
    • EC2 action if the metric is from an EC2 instance
  1. Select Create a new topic to create a new SNS topic to send the notification to and provide your email address.

Alarms4

  1. Click Create topic to create the SNS topic.
  2. Click Next, give the alarm a name and click Next again to review the configuration.
  3. Click Create to create the alarm.

Once you have created the alarm, you will notice that the alarm is now in Insufficient data state which indicates that there is not enough data to validate the alarm. Waiting for 5 minutes will change the alarm state to OK in green.

Alarms4

  1. Click on the alarm to see the alarm details as shown below.

Notice the alarm state now changed to ‘OK’ after evaluation was complete.

Alarms12

This concludes this section. You may continue on to the next section.