Cloudwatch Alarms timing

Question

I have following Cloudwatch alarms:
Alarm1 - Api Count <= 0 for 1 datapoints within 30 minutes
Alarm2 - Api Count <= 0 for 1 datapoints within 1 hour

At 12pm, I send an Api call.
Alarm1 and Alarm2 go into OK state.

I was expecting Alarm1 will go into Alarm state at 12.30 (30 minutes of no api call), but it goes into Alarm state at 13.30.

Similarly, I was expecting Alarm2 will go into Alarm state at 13.00 (1 hour of no api call), but it goes into Alarm state at 15.00.

Not sure why Alarms are not changing state after 30 minutes and 1 hour of no Api call. (it seems period is being multiplied by 3)

Other settings I have for Alarm1 are:
Period: 30 minutes
Datapoint to alarm: 1 out of 1
Missing data treatment: Treat missing data as bad (breaching threshold)
Statistic: Sum

Thanks

AmarnathAllemgari · Accepted Answer

**Alarm1 (Period: 30 minutes)**
* 1. At 12:00 PM, you send an API call. The alarm goes into the OK state.
* 2. The next evaluation happens at 12:30 PM. Since there's no new API call, CloudWatch considers this period as missing data (which is treated as bad), but it needs one more evaluation to confirm the alarm state.
* 3. At 1:00 PM (the second evaluation after 12:30 PM), it confirms no data, thus going into the alarm state at 1:30 PM.

**Alarm2 (Period: 1 hour)**
* 1. At 12:00 PM, you send an API call. The alarm goes into the OK state.
* 2. The next evaluation happens at 1:00 PM. Since there's no new API call, CloudWatch considers this period as missing data. At 2:00 PM, another evaluation happens with missing data.
* 3. Finally, at 3:00 PM, it confirms no data, and the alarm goes into the alarm state at 3:00 PM.

Sandeep · Answer

You're observing an unexpected delay in your CloudWatch alarms triggering. Despite setting Alarm1 for a 30-minute evaluation period and Alarm2 for a 1-hour evaluation period, both alarms are triggering three times later than expected.

Troubleshooting Steps

**Check Period and Evaluation Period**

Ensure that your Period is significantly smaller than your Evaluation Period.
For Alarm1, consider setting the Period to 5 minutes and Evaluation Period to 30 minutes.
For Alarm2, consider setting the Period to 5 minutes and Evaluation Period to 60 minutes.

**Adjust Datapoint to Alarm**

If you want the alarm to trigger immediately after a single breach, keep the setting at 1 out of 1.
If you want to introduce a delay, increase the value.

**Review Missing Data Treatment**
If you're confident that missing data should not trigger the alarm, change the Missing Data Treatment to "Treat missing data as missing."

**Evaluate Statistic**

If you're only interested in whether the API count is zero, using Maximum might be more appropriate than Sum.

**Verify Alarm Actions**

Ensure that alarm actions are enabled and configured correctly.

Related Documentation
Amazon CloudWatch Concepts: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html

Qadri · Answer

Thanks  @AmarnathAllemgari and @Sandeep
Both of these replies are valid. 
So I guess, the reason why the alarm is firing on expected time because Cloudwatch wants to evaluate the threshold few times because there is a missing data.

Cloudwatch Alarms timing

Relevant content