Skip to main content
Welcome. This is a concise, exam-focused summary of Domain 4 — Monitoring and Logging — for the AWS DevOps Professional exam. Domain 4 contributes ~15% of exam weight and centers on collecting observability data, analyzing it, and automating responses.
Exam tip: The exam often prefers automated responses (EventBridge, Lambda, Auto Scaling, etc.). If full automation isn’t feasible, describe a reliable manual fallback, but automation is the desired solution.
A presentation slide titled "Domain 4 at a Glance" showing three panels: "Exam Weight" (15% of the AWS DevOps Professional exam score), "3 Task Statements" (log collection, metric analysis, and automated responses), and "Core Focus" (Collect, Analyze, Automate — the three pillars of effective monitoring). The slide is branded © Copyright KodeKloud.
The guiding principle: you can’t fix what you can’t see. In exam scenarios you will be asked how to collect telemetry, analyze it, and respond — preferably automatically. Below is a structured reference you can use to answer exam questions and design real-world observability.

​
CloudWatch Logs — architecture and collection

CloudWatch Logs organizes log data into hierarchical concepts that are essential for exam scenarios. Collection methods by source:
  • EC2 / on‑prem: CloudWatch Unified Agent (supports multiline parsing, custom metrics derived from logs).
  • Lambda: automatic log delivery to CloudWatch Logs.
  • ECS: configure task definitions with awslogs or other log drivers.
  • EKS: Fluent Bit / Fluentd are common agents to forward container logs to CloudWatch or other sinks.
  • VPC Flow Logs: deliver to CloudWatch Logs or S3.
If a question mentions “CloudWatch Logs from EC2”, the CloudWatch Unified Agent is usually the expected solution in exam answers.
A presentation slide titled "Task 4.1: Log Collection Essentials" describing the CloudWatch Unified Agent with bullet points and icons. It lists common log sources (AWS Lambda, Amazon ECS, Amazon EKS, Amazon EC2, Amazon VPC) and notes the agent runs on EC2/on‑prem, handles custom parsing/multi-line logs, and suits app/infrastructure monitoring.

​
Subscription filters — one-per-log-group constraint

Important constraint for design and exam answers:
  • Each CloudWatch Logs log group supports only one active subscription filter.
Common fan-out patterns:
  • Use a single subscription filter to forward to a Kinesis Data Stream (or a Lambda that fans out). Multiple downstream consumers can read from Kinesis.
  • Alternatively, subscribe directly to a Lambda or Kinesis Data Firehose if only one destination is needed.
  • Cross-account subscriptions are supported when you configure appropriate IAM permissions and resource policies.
An infographic slide titled "The ONE Subscription Filter Limit" explaining that each log group supports only one subscription filter. It lists three steps: Understand the Constraint, Know Your Destinations (Kinesis Data Streams, Firehose, Lambda), and Implement a fan-out pattern using Kinesis Data Streams.
Practical pattern: When you must route the same log set to multiple targets, forward the log group to a Kinesis Data Stream. Let downstream consumers (Lambda, Firehose, analytics) read from the stream. This preserves the single-subscription constraint while enabling true fan-out.

​
CloudWatch Metrics — namespaces, dimensions, resolution, retention

Key concepts and configuration choices: Create metric filters when you need to convert unstructured logs into numeric metrics. After metrics exist you can combine them with math expressions, create alarms, and build dashboards.
A slide titled "Custom Metrics and Metric Filters" showing a diagram of an application publishing custom metrics to AWS CloudWatch via a CloudWatch Agent or the PutMetricData API. Examples listed include business metrics, application performance indicators, and custom health checks.
A presentation slide titled "Custom Metrics and Metric Filters" showing unstructured log data being transformed (arrow and funnel icon) into actionable CloudWatch metrics. The caption reads "Create custom metrics without changing code."

​
CloudWatch Alarms — states, types, actions

Alarms evaluate metrics and trigger actions. Understand states, types, and recommended actions: When designing exam answers, explicitly mention how the alarm triggers automation (SNS → Lambda, or EventBridge rule → Systems Manager) to demonstrate end-to-end remediation.
A presentation slide titled "Task 4.2: CloudWatch Alarms" showing three colored panels. The panels summarize Alarm States (OK, ALARM, INSUFFICIENT_DATA), Alarm Types (static threshold, anomaly detection, composite) and Alarm Actions (SNS, Auto Scaling, EC2 actions, Lambda).

​
CloudWatch Logs Insights — interactive log analytics

CloudWatch Logs Insights provides fast, interactive analytics for logs. Use it to parse, extract fields, aggregate, and create dashboards. Tips:
  • Filter the time range to reduce the amount of scanned data and lower cost (pricing is per GB scanned).
  • Use pre-built queries for common troubleshooting patterns (errors, latency, traffic spikes).
Example query — count ERROR entries in 5-minute bins:

​
Tracing — AWS X-Ray

X-Ray helps visualize request flows across distributed systems and microservices. Key concepts:
  • Trace: the end-to-end request path.
  • Segment: work done by a single service for a trace.
  • Subsegment: finer-grained operations inside a segment.
  • Annotations: indexed key/value pairs used for searching.
  • Metadata: non-indexed additional info (useful for debugging but not searchable).
  • Sampling: default sampling is the first request each second plus 5% of subsequent requests; customize sampling rules to increase/decrease coverage.
X-Ray builds a service map that highlights latency, error rates, and request counts — useful for identifying bottlenecks.
A presentation slide titled "AWS X-Ray for Distributed Tracing" that explains trace request flows and lists core components. It highlights features like end-to-end visibility, request tracking across services, and components: Segments, Subsegments, Annotations, and Metadata.
A presentation slide titled "AWS X-Ray for Distributed Tracing" showing three numbered service-map benefits. It lists: visual representation of service dependencies, shows latency/error rates/request counts, and identifies bottlenecks/failures, with sampling rules (default and custom) noted at the bottom.

​
CloudTrail — audit logging

CloudTrail records API calls and related events for your account — critical for audit, security, and forensics.
An infographic titled "CloudTrail for Audit Logging" featuring the AWS CloudTrail icon and four sections: API Call Logging, Event Types, Trail Scope, and Integration Points. It summarizes CloudTrail's audit features—recording API calls, different event types, multi-region/organization trails, and integrations with S3, CloudWatch Logs, and EventBridge.

​
Event-driven automation — EventBridge and integrations

Amazon EventBridge is the central event router in AWS. Use it to connect events to automated actions.
  • Rules use event patterns to match events and route them to targets: Lambda, Step Functions, SQS, SNS, EventBridge Pipes, and even EC2 API actions.
  • Supports scheduled (cron) rules for periodic automation.
  • Combine EventBridge with Lambda or Systems Manager Automation runbooks for automated remediation and orchestration.
When exam tasks require automated remediation, detail how CloudWatch Alarms or CloudTrail Events feed EventBridge rules that then invoke Lambda/SSM for remediation.
A presentation slide titled "Task 4.3: Event-Driven Automation" that outlines Amazon EventBridge as a central event router with three points: Event Patterns, Target Options, and Scheduled Events. The left side shows three colored icons (flowchart, target, calendar) numbered 01–03 with brief descriptions to the right.

​
AWS Config — configuration recording and compliance

AWS Config continuously records resource configurations and changes. It provides a historical audit trail and enables compliance checks.
  • Config Rules detect non-compliance. Use managed rules or author custom rules (AWS Lambda-backed or AWS Config managed).
  • Auto-remediation: Config can trigger Systems Manager Automation documents or Lambda functions to remediate non-compliant resources.
  • Conformance packs: collections of rules for standards (PCI DSS, HIPAA, CIS) — customize as needed.
A slide titled "AWS Config for Compliance Monitoring" showing the AWS Config icon and three key capabilities — continuously records resource configurations, tracks configuration changes, and provides an audit trail — plus three features listed: Config Rules, Auto-Remediation, and Conformance Packs.

​
Domain 4 quick hits (recap)

  • One subscription filter per CloudWatch Logs log group — use a Kinesis Data Stream or a fan-out Lambda to deliver to multiple destinations.
  • Metric filters convert log patterns into CloudWatch metrics without code changes.
  • Use anomaly detection and composite alarms to reduce false positives (anomaly detection requires historical metrics).
  • X-Ray traces requests across microservices and provides a service map for bottleneck identification.
  • CloudTrail logs API calls; CloudTrail Insights detects unusual activity; use Athena to query CloudTrail logs stored in S3.
  • EventBridge routes events and automates responses (schedule and content-based routing).
  • AWS Config records resource configuration, evaluates compliance, and can trigger automated remediation.
A slide titled "Domain 4 Exam Quick Hits" showing five colorful gear icons numbered 01–05 and a header note about integrating services for end-to-end monitoring. Each gear is labeled with monitoring tools: Subscription Filters, Metric Filters, X‑Ray, CloudTrail, and EventBridge, plus a footer tip on the monitoring data flow.

​
Monitoring workflow example (high level)

End-to-end workflow you can reference in answers:
  1. Collect
    • Agents and native integrations: CloudWatch Agent, Fluent Bit, service log drivers.
  2. Aggregate
    • CloudWatch Logs, custom CloudWatch metrics (PutMetricData), or a central streaming layer (Kinesis).
  3. Analyze
    • CloudWatch Metrics and dashboards, CloudWatch Logs Insights, X-Ray for distributed tracing, Athena for S3 logs.
  4. Act
    • CloudWatch Alarms → EventBridge/SNS → Lambda/Systems Manager/Auto Scaling for automated remediation.
That concludes a compact overview of Domain 4: Monitoring and Logging — focus on collection, analysis, and automated remediation to maximize exam and real-world success.

Watch Video