Looking for how to create a CloudWatch alarm based on anomaly detection? We can help you!

As a part of our AWS Support Services, we often receive similar requests from our AWS customers.

Today, let’s see the steps followed by our Support Techs to help our customers with the creation of the Amazon CloudWatch alarm.

 

CloudWatch alarm based on anomaly detection

 
Amazon CloudWatch is a monitoring and observability service from AWS. ‘anomaly detection’ is a feature of CloudWatch that uses Machine Learning to automate the creation of alarms and their thresholds.

When we enable anomaly detection for a metric, CloudWatch applies machine-learning algorithms to the metric’s historical data to create a model of the metric’s expected values.

The model generates two metrics and it represents the upper band of normal metric behavior and the lower band of normal metric behavior, with a default value of two standard deviations.

1. Firstly we need to create a JSON file to set a CloudWatch alarm based on anomaly detection.

{
"AlarmActions": [
"arn:aws:sns:us-east-1:397466294846:test1"
],
"AlarmName": "MyAlarmName",
"AlarmDescription": "This alarm uses an anomaly detection model",
"Metrics": [
{
"Id": "m1",
"ReturnData": true,
"MetricStat": {
"Metric": {
"MetricName": "NetworkIn",
"Namespace": "AWS/EC2",
"Dimensions": [
{
"Name": "InstanceId",
"Value": "i-0e1830cdc0447f6b9"
}
]
},
"Stat": "Average",
"Period": 60
}
},
{
"Id": "t1",
"Expression": "ANOMALY_DETECTION_BAND(m1, 3)"
}
],
"EvaluationPeriods": 2,
"ThresholdMetricId": "t1",
"ComparisonOperator": "LessThanLowerOrGreaterThanUpperThreshold"
}

Here the Id of m1 is assigned to the NetworkIn metric of an instance. t1 is the anomaly detection model function for the NetworkIn metric. The model uses three standard deviations to set the width of the band.

ThresholdMetricId is set to t1, and ComparisonOperator is set to LessThanLowerOrGreaterThanUpperThreshold.

This will ensure that the alarm goes into an alarm state when the metric value is outside the anomaly model band in two consecutive evaluation periods.

2. Then save the JSON file as anomaly-alarm.json.

3. To create an alarm with the anomaly detection band specified in the file, run the following command:

$ aws cloudwatch put-metric-alarm --cli-input-json file://anomaly-alarm.json

The model will generate when we finish creating the alarm.

[Need help with more AWS queries? We’d be happy to assist]
 

Conclusion

 
To conclude, today we discussed the steps followed by our Support Engineers to help our customers to create a CloudWatch alarm based on anomaly detection using AWS CLI.