CloudWatch 警报根据历史数据恢复正常答案

【问题标题】：CloudWatch alarm moving back to OK based on historic dataCloudWatch 警报根据历史数据恢复正常
【发布时间】：2020-08-04 23:00:57
【问题描述】：

我有一个 CloudWatch 警报，它检查 60 分钟窗口内的所有数据点，如果其中 5 个数据点出现问题，则 CloudWatch 警报将进入警报状态。这可以正常工作，CloudWatch 的输出显示哪些数据点出现了问题：

Message = {"AlarmName":"Test Alarm","AlarmDescription":"Test Alarm","AWSAccountId":"xxxxxxxxxx","NewStateValue":"ALARM","NewStateReason":"Threshold Crossed: 5 out of the last 5 datapoints were greater than or equal to the threshold (1.0). The most recent datapoints which crossed the threshold: [1.0 (02/08/20 10:11:00), 4.0 (02/08/20 09:56:00), 2.0 (02/08/20 09:41:00), 2.0 (02/08/20 09:26:00), 1.0 (02/08/20 09:11:00)] (minimum 5 datapoints for OK -> ALARM transition).","StateChangeTime":"2020-08-02T10:26:48.505+0000","Region":"Asia Pacific (Sydney)","AlarmArn":"xxxxxxx","OldStateValue":"OK","Trigger":{"MetricName":"Problem","Namespace":"xxxxx","StatisticType":"Statistic","Statistic":"MAXIMUM","Unit":null,"Dimensions":[{"value":"default","name":"environment"}],"Period":900,"EvaluationPeriods":5,"ComparisonOperator":"GreaterThanOrEqualToThreshold","Threshold":1.0,"TreatMissingData":"- TreatMissingData: missing","EvaluateLowSampleCountPercentile":""}}

我面临的问题是转换回 OK 状态时。在转换回 OK 时查看 CloudWatch 输出，它显示以下内容：

{"AlarmName":"Test Alarm","AlarmDescription":"Test Alarm","AWSAccountId":"xxxxxxxxx","NewStateValue":"OK","NewStateReason":"Threshold Crossed: 1 out of the last 5 datapoints [0.0 (02/08/20 09:27:00)] was not greater than or equal to the threshold (1.0) (minimum 1 datapoint for ALARM -> OK transition).","StateChangeTime":"2020-08-02T10:27:48.489+0000","Region":"Asia Pacific (Sydney)","AlarmArn":"xxxxxxxx","OldStateValue":"ALARM","Trigger":{"MetricName":"Problem","Namespace":"xxxxxxx","StatisticType":"Statistic","Statistic":"MAXIMUM","Unit":null,"Dimensions":[{"value":"default","name":"environment"}],"Period":900,"EvaluationPeriods":5,"ComparisonOperator":"GreaterThanOrEqualToThreshold","Threshold":1.0,"TreatMissingData":"- TreatMissingData: missing","EvaluateLowSampleCountPercentile":""}}

这里让我印象深刻的是：

Threshold Crossed: 1 out of the last 5 datapoints [0.0 (02/08/20 09:27:00)] was not greater than or equal to the threshold (1.0)

我理解这意味着，如果最后 5 个数据点中的任何一个未超过阈值，则将警报移回正常状态。这不是我希望闹钟的行为方式。

我想要做的是，只有在新数据点没有超出问题阈值时，它才会回到正常状态。

【问题讨论】：

标签： amazon-web-services amazon-cloudwatch

【解决方案1】：

如果我没记错的话，您的警报将只查看数据点 60 分钟。所以一旦这个窗口结束，一个新的窗口就会开始，如果你不把旧的数据点带入你的新窗口，警报会切换到 OK，因为那个新时间窗口的新数据点都不会越过阈值

【讨论】：

我假设 CloudWatch 使用滚动计时器并检查该滚动小时内的条件是否匹配，这很好。根据 CloudWatch 对其消息的表述方式：最后 5 个数据点中有 1 个不大于或等于阈值，我认为您不正确。