aws-observability

CloudWatch alarms show INSUFFICIENT_DATA when evaluation periods lack sufficient metric data points. You can configure missing-data treatment settings to specify whether the alarm should treat missing data as breaching, not breaching, or ignore it during evaluation.

CloudWatch Logs Insights supports using the `parse`, `filter`, and `sort` commands alongside subqueries to correlate log patterns across log groups. You can pinpoint failures by structuring queries with correct filtering syntax and performance constraints to join related log entries.

Embedded Metric Format (EMF) allows you to output structured JSON in logs to asynchronously create custom metrics without API calls, whereas PutMetricData is a direct synchronous API invocation. EMF avoids throttling and higher costs but requires specific JSON schema adherence for metrics to appear.

Configuring X-Ray distributed tracing with ADOT requires setting up the ADOT collector and defining sampling rules. You must use annotations for searchable trace data and metadata for non-searchable contextual information to ensure proper request flow tracing and analysis.

Yes, CloudTrail operational auditing queries allow you to identify who changed what and when using non-threat-detection event analysis. You can run CloudWatch Logs Insights queries against CloudTrail logs to filter specific API calls and attribute resource changes to specific identities.

Diagnosing CloudWatch Synthetics canary failures involves analyzing canary success metrics and checking VPC configurations. You must verify network access paths, validate alarm thresholds tied to success rates, and troubleshoot VPC settings that might block the canary endpoint connectivity.