AWS CloudWatch Support
CloudWatch alarm design that people trust.
Alarms that fire constantly get ignored, and alarms that never fire miss outages. We build alarms around symptoms users feel, such as errors and latency, set thresholds from real data and decide how each alarm treats missing data so silence is not mistaken for health.
When You Need This
The situations where this work pays for itself.
Signs it is time
- On-call is flooded with alerts that need no action
- An outage happened with no alarm firing
- Alarms flip between OK and ALARM repeatedly
- Alarms sit in INSUFFICIENT_DATA
- You monitor CPU and disk but not what customers experience
What you get
- An alarm catalogue mapping each alarm to a symptom and runbook
- Alarms defined in infrastructure as code
- Dashboards for cause analysis
- A noise review after the first month
How we do it
A clear, safe process you can follow along with.
1. List user-facing symptoms
We start from what a customer sees: error rate, latency percentile, failed jobs, queue age, and not from every resource metric. Cause metrics like CPU become dashboards and secondary signals.
2. Choose statistics and periods
We use percentiles such as p95 or p99 for latency, sum or rate for errors, and a period that matches how often data arrives. Metric math lets us alarm on error ratio instead of raw counts.
3. Set thresholds from history
We look at weeks of data to set a threshold that is above normal peaks and below customer pain. For seasonal patterns we use anomaly detection bands.
4. Use evaluation periods to cut flapping
Setting datapoints to alarm, for example 3 out of 5, filters single spikes while still reacting quickly to a sustained problem.
5. Decide how to treat missing data
For a metric that stops when a service dies, such as requests, we treat missing data as breaching. For sparse metrics we treat it as not breaching or ignore it. We choose per alarm, deliberately.
6. Attach actions and test
Each alarm goes to an SNS topic or incident tool with a clear name and description linking to a runbook. We test by forcing the alarm state and by simulating failures.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Alarming on CPU alone
High CPU may be fine. Customer errors and latency are the better signal.
Ignoring missing data behavior
A dead service sends no data, and the default can leave the alarm quiet.
One threshold for all environments
Production and test have different normal levels.
Alarms without owners or runbooks
An alert nobody can act on is noise.
Frequently Asked Questions
What should I set CloudWatch alarms on?
Start with customer-facing symptoms: error rate, latency percentiles, failed jobs and queue age, then add saturation signals such as disk, memory and connections.
Why is my CloudWatch alarm stuck in INSUFFICIENT_DATA?
The metric is not reporting for the period, often due to wrong dimensions, a stopped resource or too short a period. We check the metric exists with the same dimensions.
How do I stop alarm flapping?
Use more evaluation periods with datapoints to alarm, such as M out of N, or a longer period so a single spike does not trigger a state change.
Want Help With CloudWatch alarm design that people trust?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required