Skip to content

/AWS1/IF_CWT=>PUTLOGALARM()

About PutLogAlarm

Creates or updates a log alarm. A log alarm evaluates the results of a CloudWatch Logs scheduled query against the configured threshold and comparison operator to determine its state.

When you create a log alarm, the operation creates a service-managed CloudWatch Logs scheduled query that runs the query string you provide on the schedule you configure. Each scheduled query execution returns one or more aggregated values determined by the AggregationExpression, and each aggregated value is compared against the alarm Threshold to determine the alarm state. The alarm uses M-out-of-N evaluation: if QueryResultsToAlarm out of the most recent QueryResultsToEvaluate query results breach the threshold, the alarm transitions to ALARM.

Log alarms support the alarm states (OK, ALARM, INSUFFICIENT_DATA). Configure transition actions using OKActions, AlarmActions, and InsufficientDataActions.

If you call this operation with the name of an existing log alarm, the operation replaces the previous configuration of that alarm.

Permissions

To create or update a log alarm, you must have the cloudwatch:PutLogAlarm permission. The IAM role specified in ScheduledQueryRoleARN must grant the CloudWatch Alarms service permission to execute scheduled queries on the specified log groups. If you set ActionLogLineCount, the role specified in ActionLogLineRoleArn must grant permission to retrieve log events for inclusion in alarm notifications.

Method Signature

METHODS /AWS1/IF_CWT~PUTLOGALARM
  IMPORTING
    !IV_ALARMNAME TYPE /AWS1/CWTALARMNAME OPTIONAL
    !IV_ALARMDESCRIPTION TYPE /AWS1/CWTALARMDESCRIPTION OPTIONAL
    !IO_SCHEDULEDQUERYCONF TYPE REF TO /AWS1/CL_CWTSCHEDULEDQUERYCONF OPTIONAL
    !IV_ACTIONLOGLINECOUNT TYPE /AWS1/CWTACTIONLOGLINECOUNT OPTIONAL
    !IV_ACTIONLOGLINEROLEARN TYPE /AWS1/CWTACTIONLOGLINEROLEARN OPTIONAL
    !IV_ACTIONSENABLED TYPE /AWS1/CWTACTIONSENABLED OPTIONAL
    !IT_OKACTIONS TYPE /AWS1/CL_CWTRESOURCELIST_W=>TT_RESOURCELIST OPTIONAL
    !IT_ALARMACTIONS TYPE /AWS1/CL_CWTRESOURCELIST_W=>TT_RESOURCELIST OPTIONAL
    !IT_INSUFFICIENTDATAACTIONS TYPE /AWS1/CL_CWTRESOURCELIST_W=>TT_RESOURCELIST OPTIONAL
    !IV_QUERYRESULTSTOEVALUATE TYPE /AWS1/CWTQUERYRESULTSTOEVAL OPTIONAL
    !IV_QUERYRESULTSTOALARM TYPE /AWS1/CWTQUERYRESULTSTOALARM OPTIONAL
    !IV_THRESHOLD TYPE /AWS1/RT_DOUBLE_AS_STRING OPTIONAL
    !IV_COMPARISONOPERATOR TYPE /AWS1/CWTCOMPARISONOPERATOR OPTIONAL
    !IV_TREATMISSINGDATA TYPE /AWS1/CWTTREATMISSINGDATA OPTIONAL
    !IT_TAGS TYPE /AWS1/CL_CWTTAG=>TT_TAGLIST OPTIONAL
  RAISING
    /AWS1/CX_CWTLIMITEXCEEDEDFAULT
    /AWS1/CX_CWTRESOURCECONFLICT
    /AWS1/CX_CWTCLIENTEXC
    /AWS1/CX_CWTSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING

Required arguments:

iv_alarmname TYPE /AWS1/CWTALARMNAME /AWS1/CWTALARMNAME

The name for the alarm. This name must be unique within the Amazon Web Services account and Region.

io_scheduledqueryconf TYPE REF TO /AWS1/CL_CWTSCHEDULEDQUERYCONF /AWS1/CL_CWTSCHEDULEDQUERYCONF

The configuration of the underlying CloudWatch Logs scheduled query that this alarm evaluates, including the query string, log groups, schedule, and aggregation expression.

iv_queryresultstoevaluate TYPE /AWS1/CWTQUERYRESULTSTOEVAL /AWS1/CWTQUERYRESULTSTOEVAL

The number of most recent scheduled query results to evaluate against the threshold (the N in M-of-N evaluation). Valid range is 1 through 100.

iv_queryresultstoalarm TYPE /AWS1/CWTQUERYRESULTSTOALARM /AWS1/CWTQUERYRESULTSTOALARM

The number of query results, out of the most recent QueryResultsToEvaluate results, that must breach the threshold to trigger the alarm to transition to ALARM (the M in M-of-N evaluation). Must be less than or equal to QueryResultsToEvaluate.

iv_threshold TYPE /AWS1/RT_DOUBLE_AS_STRING /AWS1/RT_DOUBLE_AS_STRING

The value to compare with the aggregated query result.

iv_comparisonoperator TYPE /AWS1/CWTCOMPARISONOPERATOR /AWS1/CWTCOMPARISONOPERATOR

The arithmetic operation to use when comparing the aggregated query result and the threshold. The aggregated query result is used as the first operand. Valid values are GreaterThanThreshold, GreaterThanOrEqualToThreshold, LessThanThreshold, and LessThanOrEqualToThreshold.

Optional arguments:

iv_alarmdescription TYPE /AWS1/CWTALARMDESCRIPTION /AWS1/CWTALARMDESCRIPTION

The description for the alarm.

iv_actionloglinecount TYPE /AWS1/CWTACTIONLOGLINECOUNT /AWS1/CWTACTIONLOGLINECOUNT

The number of log lines from the most recent scheduled query execution to include in alarm action notifications. Valid range is 0 through 50. The default is 0, which means no log lines are included.

iv_actionloglinerolearn TYPE /AWS1/CWTACTIONLOGLINEROLEARN /AWS1/CWTACTIONLOGLINEROLEARN

The Amazon Resource Name (ARN) of an IAM role that CloudWatch assumes to retrieve log events for inclusion in alarm action notifications. Required when ActionLogLineCount is greater than 0.

iv_actionsenabled TYPE /AWS1/CWTACTIONSENABLED /AWS1/CWTACTIONSENABLED

Indicates whether actions should be executed during any changes to the alarm state. The default is true.

it_okactions TYPE /AWS1/CL_CWTRESOURCELIST_W=>TT_RESOURCELIST TT_RESOURCELIST

The actions to execute when this alarm transitions to the OK state from any other state. Each action is specified as an Amazon Resource Name (ARN).

Valid Values:

Amazon SNS actions:

arn:aws:sns:region:account-id:sns-topic-name

Lambda actions:

  • Invoke the latest version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name

  • Invoke a specific version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name:version-number

  • Invoke a function by using an alias Lambda function: arn:aws:lambda:region:account-id:function:function-name:alias-name

it_alarmactions TYPE /AWS1/CL_CWTRESOURCELIST_W=>TT_RESOURCELIST TT_RESOURCELIST

The actions to execute when this alarm transitions to the ALARM state from any other state. Each action is specified as an Amazon Resource Name (ARN).

Valid Values:

Amazon SNS actions:

arn:aws:sns:region:account-id:sns-topic-name

Lambda actions:

  • Invoke the latest version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name

  • Invoke a specific version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name:version-number

  • Invoke a function by using an alias Lambda function: arn:aws:lambda:region:account-id:function:function-name:alias-name

Systems Manager actions:

arn:aws:ssm:region:account-id:opsitem:severity

it_insufficientdataactions TYPE /AWS1/CL_CWTRESOURCELIST_W=>TT_RESOURCELIST TT_RESOURCELIST

The actions to execute when this alarm transitions to the INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN).

Valid Values:

Amazon SNS actions:

arn:aws:sns:region:account-id:sns-topic-name

Lambda actions:

  • Invoke the latest version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name

  • Invoke a specific version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name:version-number

  • Invoke a function by using an alias Lambda function: arn:aws:lambda:region:account-id:function:function-name:alias-name

iv_treatmissingdata TYPE /AWS1/CWTTREATMISSINGDATA /AWS1/CWTTREATMISSINGDATA

Sets how this alarm is to handle missing data points. Valid values are breaching, notBreaching, ignore, and missing. If this parameter is omitted, the default behavior of missing is used.

it_tags TYPE /AWS1/CL_CWTTAG=>TT_TAGLIST TT_TAGLIST

A list of key-value pairs to associate with the alarm. You can use tags to categorize and manage your alarms.

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

lo_client->putlogalarm(
  io_scheduledqueryconf = new /aws1/cl_cwtscheduledqueryconf(
    io_scheduleconfiguration = new /aws1/cl_cwtscheduleconf(
      iv_endtimeoffset = 123
      iv_scheduleexpression = |string|
      iv_starttimeoffset = 123
    )
    it_loggroupidentifiers = VALUE /aws1/cl_cwtloggroupidntfrs_w=>tt_loggroupidentifiers(
      ( new /aws1/cl_cwtloggroupidntfrs_w( |string| ) )
    )
    it_tags = VALUE /aws1/cl_cwttag=>tt_taglist(
      (
        new /aws1/cl_cwttag(
          iv_key = |string|
          iv_value = |string|
        )
      )
    )
    iv_aggregationexpression = |string|
    iv_queryarn = |string|
    iv_querystring = |string|
    iv_scheduledqueryrolearn = |string|
  )
  it_alarmactions = VALUE /aws1/cl_cwtresourcelist_w=>tt_resourcelist(
    ( new /aws1/cl_cwtresourcelist_w( |string| ) )
  )
  it_insufficientdataactions = VALUE /aws1/cl_cwtresourcelist_w=>tt_resourcelist(
    ( new /aws1/cl_cwtresourcelist_w( |string| ) )
  )
  it_okactions = VALUE /aws1/cl_cwtresourcelist_w=>tt_resourcelist(
    ( new /aws1/cl_cwtresourcelist_w( |string| ) )
  )
  it_tags = VALUE /aws1/cl_cwttag=>tt_taglist(
    (
      new /aws1/cl_cwttag(
        iv_key = |string|
        iv_value = |string|
      )
    )
  )
  iv_actionloglinecount = 123
  iv_actionloglinerolearn = |string|
  iv_actionsenabled = ABAP_TRUE
  iv_alarmdescription = |string|
  iv_alarmname = |string|
  iv_comparisonoperator = |string|
  iv_queryresultstoalarm = 123
  iv_queryresultstoevaluate = 123
  iv_threshold = |0.1|
  iv_treatmissingdata = |string|
).