AWS。Cloudwatch告警状态变更触发规则

Question

我在Cloudwatch告警状态更改时触发云监控规则时遇到问题。这是规则的事件模式。它不会向SNS发送状态改变的消息。

{
  "detail-type": [
    "CloudWatch Alarm State Change"
  ],
  "resources": [
    !Sub "arn:aws:cloudwatch:${AWS:Region}:${AWS:AccountId}:alarm:Admin dead"
  ],
  "source": [
    "aws.cloudwatch"
  ],
  "detail": {
    "state": [
      "ALARM"
    ]
  }
}

告警本身工作正常，并并行向SNS发送消息。另外，如果我要删除此部分：

"detail": {
    "state": [
      "ALARM"
    ]
  }

然后，规则对于每个状态更改都会正常工作。但我只需要将其更改为“在警报中”(因为它在UI中显示)。

感谢您的建议

Answer 1

一个不错的调试方法是删除“详细信息”部分，并通过电子邮件或lambda函数或类似的方式订阅SNS主题，以查看实际的警报事件内容。

看起来您的“详细信息”规则缺少"value“参数，以下规则有效：

{
    "source": [
        "aws.cloudwatch"
    ],
    "detail-type": [
        "CloudWatch Alarm State Change"
    ],
    "detail": {
        "state": {
            "value": [
                "ALARM"
            ]
        }
    }
}

根据this的说法，示例事件如下所示：

{
  "version": "0",
  "id": "2dde0eb1-528b-d2d5-9ca6-6d590caf2329",
  "detail-type": "CloudWatch Alarm State Change",
  "source": "aws.cloudwatch",
  "account": "123456789012",
  "time": "2019-10-02T17:20:48Z",
  "region": "us-east-1",
  "resources": [
    "arn:aws:cloudwatch:us-east-1:123456789012:alarm:TotalNetworkTrafficTooHigh"
  ],
  "detail": {
    "alarmName": "TotalNetworkTrafficTooHigh",
    "configuration": {
      "description": "Goes into alarm if total network traffic exceeds 10Kb",
      "metrics": [...]
    },
    "previousState": {
      "reason": "Unchecked: Initial alarm creation",
      "timestamp": "2019-10-02T17:20:03.642+0000",
      "value": "INSUFFICIENT_DATA"
    },
    "state": {
      "reason": "Threshold Crossed: 1 out of the last 1 datapoints [45628.0 (02/10/19 17:10:00)] was greater than the threshold (10000.0) (minimum 1 datapoint for OK -> ALARM transition).",
      "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-02T17:20:48.551+0000\",\"startDate\":\"2019-10-02T17:10:00.000+0000\",\"period\":300,\"recentDatapoints\":[45628.0],\"threshold\":10000.0}",
      "timestamp": "2019-10-02T17:20:48.554+0000",
      "value": "ALARM"
    }
  }
}

Answer 2

下面的技巧对我很有效，我想通过云监控规则获取所有处于警报状态的警报。

{
    "source": [
        "aws.cloudwatch"
    ],
    "detail-type": [
        "CloudWatch Alarm State Change"
    ],
    "detail": {
        "state": {
            "value": [
                "ALARM"
            ]
        }
    }
}