Vended Logs and Metrics

You can monitor your agent spaces and service operations by using vended Amazon CloudWatch metrics and logs. This topic describes the CloudWatch metrics that the AWS DevOps Agent automatically publishes to your account and the vended logs that you can configure for delivery to your preferred destinations.

Vended CloudWatch metrics

AWS DevOps Agent automatically publishes metrics to Amazon CloudWatch in your account. These metrics are available without any configuration. You can use them to monitor usage, track operational activity, and create alarms.

Service-Linked Role

To have Amazon CloudWatch metrics published in your account for this service, AWS DevOps Agent will automatically create the service-linked role AWSServiceRoleForAIDevOps Service-Linked Role for you. If the IAM role invoking the API do not have appropriate permission the resource creation will fail with an InvalidParameterException.

Manually Create Service-Linked Role (For existing customers)

Do one of the following:

aws iam create-service-linked-role --aws-service-name aidevops.amazonaws.com

Namespace

All metrics are published under the AWS/AIDevOps namespace.

Dimensions

All metrics include the following dimension.

Metrics reference

Viewing metrics in the CloudWatch console

Prerequisites

Before you configure log delivery, make sure that you have the following:

Vended logs

AWS DevOps Agent supports vended logs that provide visibility into events that your agent spaces and service registrations process. Vended logs use the Amazon CloudWatch Logs infrastructure to deliver logs to your preferred destination.

To use vended logs, you must configure a delivery destination. The following destinations are supported:

Supported log types

A single log type is supported: APPLICATION_LOGS. This log type covers all operational events that the service emits.

Log event types

The following table summarizes the events that AWS DevOps Agent logs.

Permissions

AWS DevOps Agent uses CloudWatch vended logs (V2 permissions) to deliver logs. To set up log delivery, the IAM role that configures the delivery must have the following permissions:

For the full IAM policy that is required for each destination type, see the following topics in the Amazon CloudWatch Logs User Guide:

Configure log delivery (console)

AWS DevOps Agent provides two locations in the AWS Management Console to configure log delivery:

To configure log delivery for a service registration

To configure log delivery for an agent space

Configure log delivery (CloudWatch API)

You can also use the CloudWatch Logs API to configure log delivery programmatically. A working log delivery consists of three elements:

Step 1: Create a delivery source

Use the PutDeliverySource operation to create a delivery source. Pass the ARN of your AWS DevOps Agent space resource and specify APPLICATION_LOGS as the log type.

The following example creates a delivery source for an agent space:

{
    "name": "my-agent-space-delivery-source",
    "resourceArn": "arn:aws:aidevops:us-east-1:123456789012:agentspace/my-agent-space-id",
    "logType": "APPLICATION_LOGS"
}

The following example creates a delivery source for the service:

{
    "name": "my-service-delivery-source",
    "resourceArn": "arn:aws:aidevops:us-east-1:123456789012:service",
    "logType": "APPLICATION_LOGS"
}

Step 2: Create a delivery destination

Use the PutDeliveryDestination operation to configure where logs are stored. You can choose Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose.

The following example creates a CloudWatch Logs destination:

{
    "name": "my-cwl-destination",
    "deliveryDestinationConfiguration": {
        "destinationResourceArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/aidevops/my-agent-space"
    },
    "outputFormat": "json"
}

The following example creates an Amazon S3 destination:

{
    "name": "my-s3-destination",
    "deliveryDestinationConfiguration": {
        "destinationResourceArn": "arn:aws:s3:::my-aidevops-logs-bucket"
    },
    "outputFormat": "json"
}

The following example creates an Amazon Data Firehose destination:

{
    "name": "my-firehose-destination",
    "deliveryDestinationConfiguration": {
        "destinationResourceArn": "arn:aws:firehose:us-east-1:123456789012:deliverystream/my-aidevops-log-stream"
    },
    "outputFormat": "json"
}

If you want to use CloudFormation, you can use the following:

The ResourceArn is the AgentSpaceArn, and LogType must be APPLICATION_LOGS as the supported log type.

Step 3: Create a delivery

Use the CreateDelivery operation to link the delivery source to the delivery destination.

{
    "deliverySourceName": "my-agent-space-delivery-source",
    "deliveryDestinationArn": "arn:aws:logs:us-east-1:123456789012:delivery-destination:my-cwl-destination"
}

AWS CloudFormation

You can also configure log delivery by using AWS CloudFormation with the following resources:

Set ResourceArn to the AWS DevOps Agent agent space or service ARN, and set LogType to APPLICATION_LOGS.

Log schema reference

AWS DevOps Agent uses a shared log schema across all event types. Not every log event uses every field.

The following table describes the fields in the log schema.

Manage and disable log delivery

You can modify or remove log delivery at any time from the AWS DevOps Agent console in the AWS Management Console or by using the CloudWatch Logs API.

Manage log delivery (console)

Disable log delivery (console)

Disable log delivery (API)

To remove a log delivery by using the API, delete the resources in the following order:

Pricing

The AWS DevOps Agent does not charge for enabling vended logs. However, you can incur charges for the delivery, ingestion, storage or access, depending on the log delivery destination that you select. For pricing details, see Vended Logs on the Logs tab at Amazon CloudWatch Pricing.

For destination-specific pricing, see the following: