Setup AWS Cloudwatch Memory and Drive Monitoring on RHEL

Download Scripts

• https://aws.amazon.com/code/8720044071969977

Install Prerequisite Packages

sudo yum install wget unzip perl-core perl-DateTime perl-Sys-Syslog perl-CPAN perl-libwww-perl perl-Crypt-SMIME perl-Crypt-SSLeay

Install LWP Perl Bundles

1. Launch cpan

   sudo perl -MCPAN -e shell
   

2. Install Bundle

   install Bundle::LWP6 LWP YAML
   

Install Script

wget http://aws-cloudwatch.s3.amazonaws.com/downloads/CloudWatchMonitoringScripts-1.2.1.zip

unzip CloudWatchMonitoringScripts-1.2.1.zip -d /opt

rm -f CloudWatchMonitoringScripts-1.2.1.zip

Setup Credentials

API Access Key (Option 1)

This is good for testing, but it’s better to use IAM roles covered in Option 2.

1. Copy awscreds template

   cp /opt/aws-scripts-mon/awscreds.template /opt/aws-scripts-mon/awscreds.conf
   

2. Add access key id and secret access key

   vim /opt/aws-scripts-mon/awscreds.conf
   

3. Lock down file access

   chmod 0400 /opt/aws-scripts-mon/awscreds.conf
   

IAM Role (Option 2)

1. Login to AWS web console
2. Select Identity & Access Management
3. Select Roles | Create New Role
4. Enter Role Name
   1. i.e. ec2-cloudwatch
5. Select Next Step
6. Select Amazon EC2
7. Search for cloudwatch
8. Select CloudwatchFullAccess
9. Select Next Step | Create Role
10. Launch a new instance and assign the ec2-cloudwatch IAM role

You can not add an IAM Role to an existing EC2 Instance; you can only specify a role when you launch a new instance.

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html?console_help=true

Test

This won’t send data to Cloudwatch.

/opt/aws-scripts-mon/mon-put-instance-data.pl --mem-util --verify --verbose

Example

MemoryUtilization: 31.7258903184253 (Percent)
Using AWS credentials file <./awscreds.conf>
Endpoint: https://monitoring.us-west-2.amazonaws.com
Payload: {"MetricData":[{"Timestamp":1443537153,"Dimensions":[{"Value":"i-12e1fac4","Name":"InstanceId"}],"Value":31.7258903184253,"Unit":"Percent","MetricName":"MemoryUtilization"}],"Namespace":"System/Linux","__type":"com.amazonaws.cloudwatch.v2010_08_01#PutMetricDataInput"}

Verification completed successfully. No actual metrics sent to CloudWatch.

Report to Cloudwatch Test

Test that communication to Cloudwatch works and design the command you’ll want to cron out in the next step.

/opt/aws-scripts-mon/mon-put-instance-data.pl --mem-util --mem-used --mem-avail

After you run this command one point-in-time metric should show up for the instance under Cloudwatch | Linux System

Create Cron Task (as root)

Now that you’ve tested out the command and figured out what you want to report it’s time to add a Cron task so it runs ever X minutes. Usually 5 minutes is good.

1. Edit cron table

   crontab -e
   

   */5 * * * * /opt/aws-scripts-mon/mon-put-instance-data.pl --mem-util --mem-used --mem-avail --disk-space-util --disk-path=/ --from-cron
   

Create Cron Task (as other user)

You may want to create a user that runs the cron. Here’s an example using a user named cloudwatch

1. Create user

   useradd cloudwatch
   

2. Disable user login

   usermod -s /sbin/nologin cloudwatch
   

3. Set ownership

   chown -R cloudwatch.cloudwatch /opt/aws-scripts-mon
   

4. Edit cron table

   crontab -e -u cloudwatch
   

5. Add cron job

   */5 * * * * /opt/aws-scripts-mon/mon-put-instance-data.pl --mem-util --mem-used --mem-avail --swap-used --disk-space-util --disk-path=/ --from-cron
   

Verify Cron Job Ran

One way to verify the cron job ran is to look in the cron log.

less /var/log/cron

tail -f /var/log/cron

References

Monitor Script Arguments