AWS SystemManagerを使用してCloudWatchを利用する方法（Linux）

1AmazonEC2RoleforSSM 2{3    "Version": "2012-10-17",4    "Statement": [5        {6            "Effect": "Allow",7            "Action": [8                "ssm:DescribeAssociation",9                "ssm:GetDeployablePatchSnapshotForInstance",10                "ssm:GetDocument",11                "ssm:DescribeDocument",12                "ssm:GetManifest",13                "ssm:GetParameters",14                "ssm:ListAssociations",15                "ssm:ListInstanceAssociations",16                "ssm:PutInventory",17                "ssm:PutComplianceItems",18                "ssm:PutConfigurePackageResult",19                "ssm:UpdateAssociationStatus",20                "ssm:UpdateInstanceAssociationStatus",21                "ssm:UpdateInstanceInformation"22            ],23            "Resource": "*"24        },25        {26            "Effect": "Allow",27            "Action": [28                "ssmmessages:CreateControlChannel",29                "ssmmessages:CreateDataChannel",30                "ssmmessages:OpenControlChannel",31                "ssmmessages:OpenDataChannel"32            ],33            "Resource": "*"34        },35        {36            "Effect": "Allow",37            "Action": [38                "ec2messages:AcknowledgeMessage",39                "ec2messages:DeleteMessage",40                "ec2messages:FailMessage",41                "ec2messages:GetEndpoint",42                "ec2messages:GetMessages",43                "ec2messages:SendReply"44            ],45            "Resource": "*"46        },47        {48            "Effect": "Allow",49            "Action": [50                "cloudwatch:PutMetricData"51            ],52            "Resource": "*"53        },54        {55            "Effect": "Allow",56            "Action": [57                "ec2:DescribeInstanceStatus"58            ],59            "Resource": "*"60        },61        {62            "Effect": "Allow",63            "Action": [64                "ds:CreateComputer",65                "ds:DescribeDirectories"66            ],67            "Resource": "*"68        },69        {70            "Effect": "Allow",71            "Action": [72                "logs:CreateLogGroup",73                "logs:CreateLogStream",74                "logs:DescribeLogGroups",75                "logs:DescribeLogStreams",76                "logs:PutLogEvents"77            ],78            "Resource": "*"79        },80        {81            "Effect": "Allow",82            "Action": [83                "s3:GetBucketLocation",84                "s3:PutObject",85                "s3:GetObject",86                "s3:GetEncryptionConfiguration",87                "s3:AbortMultipartUpload",88                "s3:ListMultipartUploadParts",89                "s3:ListBucket",90                "s3:ListBucketMultipartUploads"91            ],92            "Resource": "*"93        }94    ]95}

1CloudWatchAgentAdminPolicy 2{3    "Version": "2012-10-17",4    "Statement": [5        {6            "Effect": "Allow",7            "Action": [8                "cloudwatch:PutMetricData",9                "ec2:DescribeTags",10                "logs:PutLogEvents",11                "logs:DescribeLogStreams",12                "logs:DescribeLogGroups",13                "logs:CreateLogStream",14                "logs:CreateLogGroup"15            ],16            "Resource": "*"17        },18        {19            "Effect": "Allow",20            "Action": [21                "ssm:GetParameter",22                "ssm:PutParameter"23            ],24            "Resource": "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"25        }26    ]27}

1各種設定情報 2コマンドのドキュメント3AWS-ConfigureAWSPackage45コマンドパラメータ6Action：Install7Name：AmazonCloudWatchAgent8Version：latest

1コマンド 2$ sudo su34# /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard56=============================================================7= Welcome to the AWS CloudWatch Agent Configuration Manager =8=============================================================

1Agentを使用するOS 2On which OS are you planning to use the agent?31. linux42. windows5default choice: [1]:

1Agentを使用するサーバはEC2orオンプレ 2Trying to fetch the default region based on ec2 metadata...3Are you using EC2 or On-Premises hosts?41. EC252. On-Premises6default choice: [1]:

1Agentを実行するユーザ 2Which user are you planning to run the agent?31. root42. cwagent53. others6default choice: [1]:

1StatsDデーモンを有効or無効 2Do you want to turn on StatsD daemon?31. yes42. no5default choice: [1]:

1StatsDデーモンで使用するポート 2Which port do you want StatsD daemon to listen to?3default choice: [8125]

1StatsDデーモンのデータ収集間隔 2What is the collect interval for StatsD daemon?31. 10s42. 30s53. 60s6default choice: [1]:

1StatsDデーモンのデータ集約間隔 2What is the aggregation interval for metrics collected by StatsD daemon?31. Do not aggregate42. 10s53. 30s64. 60s7default choice: [4]:

1collectDの収集 2Do you want to monitor metrics from CollectD?31. yes42. no5default choice: [1]:2

1メトリクスの収集 2Do you want to monitor any host metrics? e.g. CPU, memory, etc.31. yes42. no5default choice: [1]:

1CPUコア単位での使用率取得（追加費用発生の可能性有） 2Do you want to monitor cpu metrics per core? Additional CloudWatch charges may apply.31. yes42. no5default choice: [1]:

1ImageId/InstanceId/InstanceType/AutoScalingGroupNameを取得可能であれば取得 2Do you want to add ec2 dimensions (ImageId, InstanceId, InstanceType, AutoScalingGroupName) into all of your metrics if the info is available?31. yes42. no5default choice: [1]:

1メトリクスの取得間隔 23Would you like to collect your metrics at high resolution (sub-minute resolution)? This enables sub-minute resolution for all metrics, but you can customize for specific metrics in the output json file.41. 1s52. 10s63. 30s74. 60s8default choice: [4]:

1取得するメトリクスの種類 2Which default metrics config do you want?31. Basic42. Standard53. Advanced64. None7default choice: [1]:3

1上記で選択した取得するメトリクスの内容 2Current config as follows:3{4        "agent": {5                "metrics_collection_interval": 60,6                "run_as_user": "root"7        },8        "metrics": {9                "append_dimensions": {10                        "AutoScalingGroupName": "${aws:AutoScalingGroupName}",11                        "ImageId": "${aws:ImageId}",12                        "InstanceId": "${aws:InstanceId}",13                        "InstanceType": "${aws:InstanceType}"14                },15                "metrics_collected": {16                        "collectd": {17                                "metrics_aggregation_interval": 6018                        },19                        "cpu": {20                                "measurement": [21                                        "cpu_usage_idle",22                                        "cpu_usage_iowait",23                                        "cpu_usage_user",24                                        "cpu_usage_system"25                                ],26                                "metrics_collection_interval": 60,27                                "resources": [28                                        "*"29                                ],30                                "totalcpu": false31                        },32                        "disk": {33                                "measurement": [34                                        "used_percent",35                                        "inodes_free"36                                ],37                                "metrics_collection_interval": 60,38                                "resources": [39                                        "*"40                                ]41                        },42                        "diskio": {43                                "measurement": [44                                        "io_time",45                                        "write_bytes",46                                        "read_bytes",47                                        "writes",48                                        "reads"49                                ],50                                "metrics_collection_interval": 60,51                                "resources": [52                                        "*"53                                ]54                        },55                        "mem": {56                                "measurement": [57                                        "mem_used_percent"58                                ],59                                "metrics_collection_interval": 6060                        },61                        "netstat": {62                                "measurement": [63                                        "tcp_established",64                                        "tcp_time_wait"65                                ],66                                "metrics_collection_interval": 6067                        },68                        "statsd": {69                                "metrics_aggregation_interval": 60,70                                "metrics_collection_interval": 10,71                                "service_address": ":8125"72                        },73                        "swap": {74                                "measurement": [75                                        "swap_used_percent"76                                ],77                                "metrics_collection_interval": 6078                        }79                }80        }81}

1取得するメトリクスは上記でいいか 23Are you satisfied with the above config? Note: it can be manually customized after the wizard completes to add additional items.41. yes52. no6default choice: [1]:

1CloudWatchLogs使用しているか 23Do you have any existing CloudWatch Log Agent (http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html) configuration file to import for migration?41. yes52. no6default choice: [2]:

1取得したいログファイルはあるか 2Do you want to monitor any log files?31. yes42. no5default choice: [1]:

1取得したいログファイルをフルパスで指定 2Log file path:/var/log/httpd/access_log

1ロググループ名を指定 2Log group name:3default choice: [access_log]

1ログストリーム名を指定 2Log stream name:3default choice: [{instance_id}]

1追加取得したいログファイルはあるか 2Do you want to specify any additional log files to monitor?31. yes42. no5default choice: [1]:2

1取得するメトリクスとログファイルの内容（内容を修正する場合はSSMコンソールのパラメータストアを編集） 2Saved config file to /opt/aws/amazon-cloudwatch-agent/bin/config.json successfully.3Current config as follows:4{5        "agent": {6                "metrics_collection_interval": 60,7                "run_as_user": "root"8        },9        "logs": {10                "logs_collected": {11                        "files": {12                                "collect_list": [13                                        {14                                                "file_path": "/opt/tomcat/logs/access.log",15                                                "log_group_name": "access.log",16                                                "log_stream_name": "@@@@@"17                                        },18                                        {19                                                "file_path": "/var/log/httpd/error_log",20                                                "log_group_name": "errorlog",21                                                "log_stream_name": "@@@@@"22                                        },23                                        {24                                                "file_path": "/var/log/httpd/access_log",25                                                "log_group_name": "access_log",26                                                "log_stream_name": "@@@@@"27                                        }28                                ]29                        }30                }31        },32        "metrics": {33                "append_dimensions": {34                        "AutoScalingGroupName": "${aws:AutoScalingGroupName}",35                        "ImageId": "${aws:ImageId}",36                        "InstanceId": "${aws:InstanceId}",37                        "InstanceType": "${aws:InstanceType}"38                },39                "metrics_collected": {40                        "collectd": {41                                "metrics_aggregation_interval": 6042                        },43                        "cpu": {44                                "measurement": [45                                        "cpu_usage_idle",46                                        "cpu_usage_iowait",47                                        "cpu_usage_user",48                                        "cpu_usage_system"49                                ],50                                "metrics_collection_interval": 60,51                                "resources": [52                                        "*"53                                ],54                                "totalcpu": false55                        },56                        "disk": {57                                "measurement": [58                                        "used_percent",59                                        "inodes_free"60                                ],61                                "metrics_collection_interval": 60,62                                "resources": [63                                        "*"64                                ]65                        },66                        "diskio": {67                                "measurement": [68                                        "io_time",69                                        "write_bytes",70                                        "read_bytes",71                                        "writes",72{73                                        "reads"74                                ],75                                "metrics_collection_interval": 60,76                                "resources": [77                                        "*"78                                ]79                        },80                        "mem": {81                                "measurement": [82                                        "mem_used_percent"83                                ],84                                "metrics_collection_interval": 6085                        },86                        "netstat": {87                                "measurement": [88                                        "tcp_established",89                                        "tcp_time_wait"90                                ],91                                "metrics_collection_interval": 6092                        },93                        "statsd": {94                                "metrics_aggregation_interval": 60,95                                "metrics_collection_interval": 10,96                                "service_address": ":8125"97                        },98                        "swap": {99                                "measurement": [100                                        "swap_used_percent"101                                ],102                                "metrics_collection_interval": 60103                        }104                }105        }106}107Please check the above content of the config.108The config file is also located at /opt/aws/amazon-cloudwatch-agent/bin/config.json.109Edit it manually if needed.

1SSMのパラメータストアに設定ファイルを保持しますか 2Do you want to store the config in the SSM parameter store?31. yes42. no5default choice: [1]:

1パラメータストアの設定ファイル名を指定(先頭に"AmazonCloudWatch-"を必ず使用/ユニークで指定するのがいい) 2What parameter store name do you want to use to store your config? (Use 'AmazonCloudWatch-' prefix if you use our managed AWS policy)3default choice: [AmazonCloudWatch-linux]4AmazonCloudWatch-@@@@

1設定ファイルを保持するリージョンを指定 2Trying to fetch the default region based on ec2 metadata...3Which region do you want to store the config in the parameter store?4default choice: [ap-northeast-1]

1SSMパラメータストアにデータを送信するのにアクセスキーを使用するか 2Which AWS credential should be used to send json config to parameter store?31. ASIABBBCCC111222DD33(From SDK)42. Other5default choice: [1]:

1保存に成功するとSSMコンソールのパラメータストアに保存されているので確認 2Successfully put config to parameter store AmazonCloudWatch-fi-gridadm.3Program exits now.

1パラメータストアの設定ファイル読み込み 23# /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config  -m ec2 -c ssm:AmazonCloudWatch-@@@@ -s

1CloudWatchAgentのステータス確認 23# systemctl status amazon-cloudwatch-agent.service

1CloudWatchAgentの自動起動有効化 23# systemctl is-enabled amazon-cloudwatch-agent.service