Log Groups, Streams, Retention, and Access

Understand the log hierarchy

A log group is the container for a log source and its retention and access controls. A log stream is a sequence of events from a particular source. RDS naming conventions typically include the resource and log type, but exact names depend on the service. Prefer the database resource's Logs & events view to locate the destination rather than guessing.

1. Confirm account and Region in the console.
2. Open the database resource and identify the exported log type.
3. Open the linked CloudWatch log group and select the relevant stream(s).
4. Set the incident time window and inspect the event time and message.

Retention, protection, and query scope

Set retention according to operational, legal, and security requirements; log groups may otherwise retain data indefinitely. Restrict read, query, export, and deletion permissions to approved roles. Use KMS encryption and cross-account sharing only under the organization's controls. Query the narrowest relevant log groups and time range to reduce cost and noise.

Search across logs

CloudWatch Logs Insights can query multiple selected groups. Start with a narrow time range and a simple query:

fields @timestamp, @logStream, @message
| sort @timestamp desc
| limit 50

Then add a filter for an error term or known request ID:

fields @timestamp, @logStream, @message
| filter @message like /ERROR|FATAL|deadlock/
| sort @timestamp desc
| limit 100

Search terms are examples; PostgreSQL and application log formats differ. Refine using the actual emitted field names and message text.

Common navigation problems

• No log group: confirm exports are enabled and wait for the service to publish events.
• No stream for the time: check the selected resource, engine log type, and time zone.
• Access denied: confirm approved IAM permissions and account/Region, then request access rather than broadening a role.
• Unexpected cost: narrow the time range and groups; review ingestion volume and retention settings.