Guide / Logs, metrics and lenses

Logs, metrics and lenses

Several views open inside the detail pane rather than as full-screen modals. Each takes over the keymap while open; Esc closes it and Z makes the pane full-width.

Metrics (m)

Charts for most resource kinds that publish CloudWatch metrics, each with the right namespace and dimension set: EC2, EBS, Lambda, ECS services and tasks, RDS, load balancers, DynamoDB, SQS, Kinesis, MSK, API Gateway, CloudFront, NAT gateways, VPN and Direct Connect, and so on.

Every kind opens the same view. Each metric gets a row with a sparkline and its last, min, max and average in its unit. Below the rows is a large chart of the selected one, and related metrics, such as bytes in and out, share it. j / k pick the row.

The range row ends with where the data comes from: the namespace and the home region, plus the dimensions for a CloudWatch metric row. If nothing was published in the window, the view says so and suggests a longer range.

On a WAF web ACL, the actions (Allowed, Blocked, Counted, CAPTCHA, Challenge) share one chart, with a Block rate row, and the rule and label tables sit beside it. Tab moves into the tables, Enter charts that rule’s or label’s actions, d goes back to the ACL’s set, and x opens the sampled requests for the rule under the cursor in your editor (AWS keeps the last 3 hours). A CloudFront distribution charts Blocked by WAF beside its requests, and says when a row needs the distribution’s additional metrics turned on.

On a CloudWatch dashboard, m renders the dashboard itself: its widgets laid out on the console’s own grid, with Tab walking a widget cursor and Enter zooming one to the whole pane.

Each chart also marks what changed: the resource’s change timeline events (CloudTrail changes, deploys, stack events, Auto Scaling and RDS events, alarm changes) are drawn as vertical lines, failed ones in the error colour. A legend on the pane’s bottom border names each event once, newest first, with a count (StopInstances ×7). c turns them off and on for the session. W opens those events as the change timeline, and Esc returns to the charts as you left them. CloudTrail is read up to 50 matched events. If the chart’s window goes back further than that, the legend says N+ changes, or no changes since <time>, rather than calling the unread stretch quiet. Dashboards and Cost don’t get markers.

GetMetricData bills per metric requested, so the dashboard view caps the number of series it fetches and never fires automatically.

Log tail and search (t, f)

t tails a log group live, seeded from a lookback window (default 15 minutes). It also works on things that have logs: a Lambda function, an RDS instance, an ECS task, a WAF web ACL, a CloudTrail trail, a Step Functions execution, a CodeBuild project. f on a log group runs a one-shot server-side search with a CloudWatch filter pattern over a chosen range; s flips a live tail into a search on the same group. y copies the buffer, e opens it in $EDITOR.

Change timeline (W)

“What changed around this resource?” Its sources are merged newest-first, each row wearing a badge: CloudTrail events that name the resource, CloudWatch alarm state changes, CloudFormation stack events for the owning stack, ECS deployments, Auto Scaling activities (for a group, or an instance in one) and RDS events (RDS keeps only 14 days). The last two are what AWS itself does, which CloudTrail never records. Works on any resource, from either pane. Enter opens the raw event in $EDITOR.

What changed, account-wide (@changes)

W answers “what changed around this resource?”. @changes asks “what changed just before this started?” across the whole account. It’s a service like any other: one regional list, newest first, over a [ / ] window from 15 minutes to 7 days.

IAM and Organizations are global, so CloudTrail records them only in us-east-1. @changes looks them up there whichever region you’re in. AWS-service and session events are noise, so a hides them; IAM changes never are. CloudTrail’s lookup is rate-limited and shared, so it reads the newest 500 write events at most, and the warning says how far back that reached. Each source is optional: a denied one is a warning, and the rest still list. Enter follows a row to the resource it changed, where the source names one.

Referenced by (U) and network access (N)

U is the reverse of ownership: every loaded resource that mentions the selected one, by id, name, ARN or tag. It scans only what is cached, so it makes no API calls and says how much it covered.

N on anything with security groups (an instance, an RDS instance, a Lambda, a load balancer…) shows the effective rule table across every attached group in one view, with open-to-world sources highlighted. Enter jumps to the group a row came from.

Below the security-group rules come the network ACLs on the resource’s subnets, in rule order, since the first match wins. A deny is in the warning colour, and an ACL that opens everything both ways is labelled allow-all. Enter on an ACL row jumps to the ACL. Load balancers get their subnets’ ACLs too.

The editor (e)

e opens the current resource in $EDITOR (falling back to vim). What it opens depends on context: a fetched IAM policy document, a CloudFormation template, an S3 object, a Step Functions payload, a raw finding JSON, or by default the full detail-pane snapshot as JSON, so e always opens something useful.