AWS CloudWatch Logs and Monitoring Foundations

What CloudWatch Logs does

Amazon CloudWatch Logs stores and lets you query log events sent by AWS services, agents, and applications. Logs are grouped into log groups; log streams usually represent an instance, task, or log source. CloudWatch is an observability destination, not a live SQL session: a log search cannot show a query that the database has not emitted.

Choose the right evidence source

• Database engine log: authentication failures, deadlocks, checkpoints, server warnings, and statements the configured logging policy records.
• Application log: request IDs, endpoint errors, pool wait, retry, and the application-side duration around a database call.
• CloudWatch metrics: CPU, storage, connections, latency, and service-level trends; metrics are not query text.
• Database activity view: for currently active PostgreSQL work, query pg_stat_activity with an authorized database connection.

Start an investigation

1. Select the correct AWS account, Region, environment, and database resource.
2. Confirm the engine, log export configuration, destination log group, and retention.
3. Write down the symptom, timezone, first/last observed time, and customer impact.
4. Search a narrow time window, then widen it to include lead-up and recovery.
5. Correlate database log events with application logs, metrics, deploys, and incident notes.

Safe access and cost basics

Use an approved IAM role scoped to the required account, Region, and log groups. Logs can contain SQL text, usernames, host details, and sensitive values. Limit access, avoid logging secrets or personal data, configure retention, and use approved encryption and export policies. High-volume logs and broad, long-range queries can cost more; begin with a small time range.