> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo Core AWS Monitoring Tools CloudWatch X ray Config and CloudTrail > Overview of four AWS observability services CloudWatch X-Ray AWS Config and CloudTrail explaining their purposes integrations and use cases for monitoring tracing compliance and auditing Welcome. This article gives a concise, high-level overview of four core AWS monitoring and observability services. It explains what each service provides, where it fits in an operational workflow, and the most common integration points. Covered services: * Amazon CloudWatch — metrics, logs, dashboards, and alarms * AWS X-Ray — distributed application tracing * AWS Config — resource configuration tracking and inventory * AWS CloudTrail — API activity logging and auditing This is an orientation-level overview designed to help you decide which service to use for a particular monitoring, troubleshooting, or auditing need. Links to the official docs appear in the References section to help you dive deeper. ## CloudWatch Amazon CloudWatch is the primary monitoring and observability service in AWS. It collects metrics and logs from AWS services and applications, provides visualization (dashboards), and supports alarms and automated responses. Key capabilities: * Metrics — numerical time-series (e.g., `CPUUtilization`, `NetworkIn`, `StatusCheckFailed`) for services and custom metrics from your apps. * Logs — ingest application, OS, and service logs via CloudWatch Logs. Query them interactively with CloudWatch Logs Insights. * Dashboards — combine chart widgets, single-value (number) widgets, and text to build operational views. * Alarms — trigger notifications (SNS), Auto Scaling, or Lambda functions based on thresholds and anomaly detection. ![A browser screenshot of the Amazon Web Services CloudWatch console showing the Overview page. The view includes the left navigation menu, time-range and action controls across the top, and a "Get started with CloudWatch" / "Configure the CloudWatch Agent" panel in the main area.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/Demo-Core-AWS-Monitoring-Tools-CloudWatch-X-ray-Config-and-CloudTrail/aws-cloudwatch-overview-console-screenshot.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=86e19bc4207785000dbca93790d63a73) Metrics Explorer and dashboards * Use the Metrics Explorer to browse by namespace, service, and resource. * For EC2, common metrics include `CPUUtilization`, `CPUCreditBalance`, `NetworkIn`, and `NetworkOut`. * Add metrics to dashboards to get at-a-glance health indicators for instances, databases, or entire stacks. ![A screenshot of the AWS CloudWatch Explorer console showing selected EC2 metrics (CPUCreditUsage, CPUCreditBalance, CPUSurplusCreditBalance, CPUUtilization) listed in the left pane. The right side shows empty chart panels and instructions to choose a metric.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/Demo-Core-AWS-Monitoring-Tools-CloudWatch-X-ray-Config-and-CloudTrail/cloudwatch-explorer-ec2-metrics-empty-charts.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=7c88613a344e91310c1a29dcb6b72093) Logs and Logs Insights * CloudWatch Logs collects log streams from ECS, Lambda, EC2 (via CloudWatch Agent), and other sources. * Logs Insights provides an ad-hoc SQL-like query language for fast analysis. Example Logs Insights query to show top 10 slowest requests (adjust fields for your application): ```sql theme={null} fields @timestamp, @message, latency | sort latency desc | limit 10 ``` Custom metrics and the CloudWatch Agent * Push application metrics (e.g., request rates, business KPIs) with `PutMetricData` or by using the CloudWatch Agent for system-level metrics (memory, disk). * Use dashboards and anomaly detection to quickly spot outliers. ## X-Ray AWS X-Ray provides distributed tracing for applications. It tracks requests as they flow through services, revealing latency hotspots and error sources. Core concepts: * Traces — capture the path of a request through your system, composed of segments and subsegments. * Segments/subsegments — represent work done by services, frameworks, or downstream calls; they contain timing, annotations, and error data. * Service map — a visual graph that shows service interactions and highlights nodes or edges with high latency or errors. * Instrumentation — integrate X-Ray with supported AWS services, SDKs, or use OpenTelemetry for custom instrumentation. ![A screenshot of the AWS CloudWatch web console showing the left navigation menu and a main panel describing X-Ray features. The text highlights server- and client-side latency detection and OpenTelemetry support.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/Demo-Core-AWS-Monitoring-Tools-CloudWatch-X-ray-Config-and-CloudTrail/aws-cloudwatch-console-xray-latency-opentelemetry.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=aeb361c28a6dde5c7b090b2c50a996d2) When to use X-Ray: * Identify latency between services in microservices architectures. * Trace a single request end-to-end to find where exceptions or retries occur. * Augment CloudWatch metrics and logs with per-request context for faster root cause analysis. ## AWS Config AWS Config maintains resource configuration snapshots and records configuration changes over time—useful for auditing, compliance, and troubleshooting configuration drift. Capabilities: * Resource inventory — a searchable catalog of recorded resources and their configuration states. * Configuration history — view how a resource’s configuration changed across time. * Rules & Compliance — author rules (managed or custom) to evaluate resources against governance policies and get compliance reports. ![A screenshot of the AWS Config console open to the "Resource Inventory" page, showing explanatory text, filters (resource category, resource type, compliance) and a "Resources (28+)" summary. The browser header and account/organization navigation are visible across the top.](https://mintcdn.com/kodekloud-c4ac6d9a/FoKJ_KwuI1oFSFo9/images/AWS-Certified-DevOps-Engineer-Professional/Domain-4-Monitoring-and-Logging/Demo-Core-AWS-Monitoring-Tools-CloudWatch-X-ray-Config-and-CloudTrail/aws-config-resource-inventory-screenshot.jpg?fit=max\&auto=format\&n=FoKJ_KwuI1oFSFo9\&q=85\&s=6958c5e7683bc360fefdbb879a2e9f92) Common patterns: * Enable the Config recorder and deliver snapshots to an S3 bucket for long-term retention. * Use Config Rules to detect drift (e.g., open security groups, unencrypted volumes) and generate reports. * Combine Config history with CloudTrail events to see both “what changed” and “who changed it.” ## CloudTrail AWS CloudTrail records account-level and (optionally) data plane API activity. It answers “who did what, when, and from where” for API calls across your account and organization. Primary features: * Event history — searchable recent API actions (time, API call, user identity, source IP, and resources). * Trails — configure multi-region, organization-wide trails to deliver events to S3, CloudWatch Logs, or to integrate with security tooling. * Use cases — security auditing, operational troubleshooting, forensic analysis, and compliance evidence. Best practice CLI example to create a multi-region trail that sends logs to an S3 bucket: ```bash theme={null} aws cloudtrail create-trail --name my-trail \ --s3-bucket-name my-cloudtrail-bucket \ --is-multi-region-trail aws cloudtrail start-logging --name my-trail ``` Security and retention considerations For production workloads, enable a multi-region trail and deliver CloudTrail logs to a dedicated S3 bucket with strict IAM policies and lifecycle rules. This prevents accidental deletion and ensures logs are retained for audits and incident response. How these services work together * CloudWatch: operational metrics, dashboards, and alarms for real-time health and automated responses. * X-Ray: per-request traces and service maps to troubleshoot performance and latency at the application level. * AWS Config: configuration snapshots and compliance checks to detect drift and prove governance. * CloudTrail: immutable audit trail of API activity for security and forensics. Comparison summary | Service | Primary purpose | Typical outputs | Common actions | | - | -: | - | - | | CloudWatch | Monitoring metrics & logs | Metrics, dashboards, alarms, Logs Insights queries | Create alarms, build dashboards, query logs | | X-Ray | Distributed tracing | Traces, service map, segment details | Instrument apps, analyze traces for latency/errors | | AWS Config | Configuration tracking & compliance | Resource inventory, configuration history, rule evaluations | Enable recorder, run compliance rules, audit changes | | CloudTrail | API activity audit | Event history, S3-delivered logs, CloudWatch Logs | Create trails, enable multi-region logging, retain logs for audits | References and next steps * Amazon CloudWatch docs: [https://docs.aws.amazon.com/cloudwatch/](https://docs.aws.amazon.com/cloudwatch/) * AWS X-Ray docs: [https://docs.aws.amazon.com/xray/](https://docs.aws.amazon.com/xray/) * AWS Config docs: [https://docs.aws.amazon.com/config/](https://docs.aws.amazon.com/config/) * AWS CloudTrail docs: [https://docs.aws.amazon.com/cloudtrail/](https://docs.aws.amazon.com/cloudtrail/) These four services complement each other: use CloudWatch for operational metrics and alerts, X-Ray for request-level tracing, AWS Config for configuration and compliance history, and CloudTrail for auditing API activity. Together they provide a comprehensive observability and governance foundation on AWS. This overview is intended to orient you to what each service does and typical ways to instrument and integrate them. For implementation details (agent configuration, SDK instrumentation, rule authoring, and retention policies) consult the linked official documentation and implementation guides. > **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/15ed9473-60f4-466a-b7b2-3d9cb829e847/lesson/41d94509-a597-4b2e-ac0a-d4ca1027e9d8)** This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.