I have configured an Amazon CloudWatch alarm to check a value for multiple periods; however, the alarm is going into ALARM after just one period breaches the threshold.
CloudWatch alarm metrics are defined using comparison operators to measure whether data points received at set intervals exceed a specified threshold. If the data points received exceed the specified threshold, a metric breach occurs. If a metric breach occurs for x consecutive intervals where x = alarm minimum breach period, the alarm goes into the ALARM state.
CloudWatch alarms may also go into the ALARM state when a single metric breach is followed by x-1 consecutive periods of insufficient data and/or metric breaches. This behavior is common with alarms that track a metric that does not consistently receive data every period. For example if you have a custom metric that sends a '1' to CloudWatch each time a specific error occurs, you may have periods where no '1' is sent because no error occurred.
When CloudWatch evaluates metrics to determine whether to go into the ALARM state, it treats periods of insufficient data following a metric breach point as breaching when the oldest data point is breaching. For example let’s say you have an alarm that is configured as follows:
Threshold: 50
Operator: Greater than or equal to
Period: 60 (seconds)
Number of periods: 4
A metric breach occurs (oldest data is to the left, newest data is to the right, ID signifies Insufficient Data for that period):
| 7 | ID | ID | 55 |
1 2 3 4
This evaluates to an alarm state of OK
Next minute:
| ID | ID | 55 | ID |
1 2 3 4
This evaluates to an alarm state of OK
Next minute:
| ID | 55 | ID | ID |
1 2 3 4
This evaluates to an alarm state of OK
One more minute:
| 55 | ID | ID | ID |
1 2 3 4
This evaluates to an alarm state of ALARM
When the oldest data point in an evaluation period is a metric breach followed by either additional metric breaches or by insufficient data, CloudWatch goes into the ALARM state.
- Use larger single evaluation periods to prevent periods of inactivity from triggering the alarm. For example, if your alarm is currently configured to evaluate 3 periods of 5 minutes, use a single period of 15 minutes instead.
- When publishing custom metrics, configure the application that is pushing the metrics to send a '0' during periods of inactivity.
CloudWatch, alarm, insufficient data, threshold, multiple, breach
Did this page help you? Yes | No
Back to the AWS Support Knowledge Center
Need help? Visit the AWS Support Center
Published: 2016-04-29
Updated: 2016-05-10
