# Logging and monitoring in AWS Elemental MediaPackage
Monitoring is an important part of maintaining the reliability, availability, and performance of AWS Elemental MediaPackage and your other AWS solutions. AWS provides the following monitoring tools to watch MediaPackage, report when something is wrong, and take automatic actions when appropriate:
+ *Amazon CloudWatch* monitors your AWS resources and the applications that you run on AWS in real-time. You can collect and track metrics, create customized dashboards, and set alarms that notify you or take actions when a specified metric reaches a threshold that you specify. For example, you can have CloudWatch track CPU usage or other metrics of your Amazon EC2 instances and automatically launch new instances when needed. For more information, see the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/).
+ *Amazon CloudWatch Events* delivers a near real-time stream of system events that describe changes in AWS resources. CloudWatch Events enables automated event-driven computing, as you can write rules that watch for certain events and trigger automated actions in other AWS services when these events happen. For more information, see the [Amazon CloudWatch Events User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/).
+ *AWS CloudTrail* captures API calls and related events made by or on behalf of your AWS account and delivers the log files to an Amazon S3 bucket that you specify. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred. For more information, see the [AWS CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/).
+ *AWS Elemental MediaPackage access logs* provide detailed records about requests that are made to a channel. Access logs are useful for many applications. For example, access log information can be useful in security and access audits. For more information, see [Access logging](access-logging.md).
+ *MediaPackage manifest update headers* indicate when the service last updated the manifest and segment sequence in workflows that don't use dynamic ad insertion. MediaPackage includes these custom headers in playback responses. These headers are helpful when troubleshooting issues related to stale manifests. For more information, see [Monitoring manifest update time](monitoring-manifest-last-updated.md).
**Topics**
+ [
# Monitoring AWS Elemental MediaPackage with Amazon CloudWatch metrics
](monitoring-cloudwatch.md)
+ [
# Monitoring AWS Elemental MediaPackage with CloudWatch Events
](monitoring-cloudwatch-events.md)
+ [
# Logging AWS Elemental MediaPackage API calls with AWS CloudTrail
](logging-using-cloudtrail.md)
+ [
# Access logging
](access-logging.md)
+ [
# Monitoring manifest update time
](monitoring-manifest-last-updated.md)
+ [
# Monitoring AWS media services with workflow monitor
](monitor-with-workflow-monitor.md)
# Monitoring AWS Elemental MediaPackage with Amazon CloudWatch metrics
You can monitor AWS Elemental MediaPackage using CloudWatch, which collects raw data and processes it into readable, near real-time metrics. These statistics are kept for 15 months, so that you can access historical information and gain a better perspective on how your web application or service is performing. You can also set alarms that watch for certain thresholds, and send notifications or take actions when those thresholds are met. For more information, see the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/).
**To view metrics using the MediaPackage console**
MediaPackage displays metrics throughout the console.
1. Open the MediaPackage console at [https://console.aws.amazon.com/mediapackage/](https://console.aws.amazon.com/mediapackage/).
1. Navigate to the appropriate page to view metrics:
+ For metrics on all channels and endpoints in the AWS Region, go to the **Channels** page.
+ For metrics on a specific channel and all of its endpoints, go to the channel's details page.
+ For metrics on a specific endpoint and its channel, go to the endpoint's details page.
1. (Optional) To refine the metrics view, choose **Open in CloudWatch**.
**To view metrics using the CloudWatch console**
Metrics are grouped first by the service namespace, and then by the various dimension combinations within each namespace.
1. Sign in to the AWS Management Console and open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/).
1. In the navigation pane, choose **Metrics**.
1. Under **All metrics**, choose the **AWS/MediaPackage** namespace.
1. Choose the metric dimension to view the metrics (for example, choose `channel` to view metrics per channel).
**To view metrics using the AWS CLI**
At a command prompt, use the following command:
```
aws cloudwatch list-metrics --namespace "AWS/MediaPackage"
```
**Topics**
+ [
# AWS Elemental MediaPackage live content metrics
](metrics.md)
+ [
# AWS Elemental MediaPackage VOD content metrics
](metrics-vod.md)
# AWS Elemental MediaPackage live content metrics
The `AWS/MediaPackage` namespace includes the following metrics for live content. AWS Elemental MediaPackage publishes metrics to CloudWatch every minute, if not sooner.
| Metric | Description |
| --- | --- |
| ActiveInput | Indicates if an input has been used as the source for an endpoint in MediaPackage (it has been active). A value of 1 indicates that the input was active, and a 0 (zero) indicates that it wasn't. Units: NoneValid dimension: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
| EgressBytes | Number of bytes that MediaPackage successfully sends for each request. If MediaPackage doesn't receive any requests for output in the specified interval, then no data is given.Units: BytesValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html)Valid dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
| EgressRequestCount | Number of content requests that AWS Elemental MediaPackage receives. If MediaPackage doesn't receive any requests for output in the specified interval, then no data is given.Units: CountValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html)Valid dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
| EgressResponseTime | The time that it takes MediaPackage to process each output request. If MediaPackage doesn't receive any requests for output in the specified interval, then no data is given.Units: MillisecondsValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html)Valid dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
| IngressBytes | Number of bytes of content that AWS Elemental MediaPackage receives for each input request. If MediaPackage doesn't receive any requests for input in the specified interval, then no data is given.Units: BytesValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html)Valid dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
| IngressResponseTime | The time that it takes MediaPackage to process each input request. If MediaPackage doesn't receive any requests for input in the specified interval, then no data is given.Units: MillisecondsValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html)Valid dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
## AWS Elemental MediaPackage live dimensions
You can filter the `AWS/MediaPackage` data using the following dimensions.
| Dimension | Description |
| --- | --- |
| No Dimension | Metrics are aggregated and shown for all channels, endpoints, or status codes. |
| `Channel` | Metrics are shown only for the specified channel. Value: The autogenerated GUID of the channel. Can be used alone or with other dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
| `IngestEndpoint` | Metrics are shown only for the specified ingest endpoint on a channel. Value: The autogenerated GUID of the ingest endpoint. Can be used with the following dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
| `OriginEndpoint` | Metrics are shown for the specified channel and endpoint combination. Value: The autogenerated GUID of the endpoint. Must be used with the `channel` dimension. |
| `StatusCodeRange` | Metrics are shown for the specified status code range. Value: `2xx`, `3xx`, `4xx`, or `5xx`. Can be used alone or with other dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics.html) |
# AWS Elemental MediaPackage VOD content metrics
The `AWS/MediaPackage` namespace includes the following metrics for video on demand (VOD) content. AWS Elemental MediaPackage publishes metrics to CloudWatch every minute, if not sooner.
| Metric | Description |
| --- | --- |
| EgressBytes | Number of bytes that MediaPackage successfully sends for each request. If MediaPackage doesn't receive any requests for output in the specified interval, then no data is given.Units: BytesValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html)Valid dimensions:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html) |
| EgressRequestCount | Number of content requests that MediaPackage receives. If MediaPackage doesn't receive any requests for output in the specified interval, then no data is given.Units: CountValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html)Valid dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html) |
| EgressResponseTime | The time that it takes MediaPackage to process each output request. If MediaPackage doesn't receive any requests for output in the specified interval, then no data is given.Units: MillisecondsValid statistics:[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html)Valid dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html) |
## AWS Elemental MediaPackage VOD dimensions
You can filter the `AWS/MediaPackage` data using the following dimensions.
| Dimension | Description |
| --- | --- |
| No Dimension | Metrics are aggregated and shown for all packaging configurations and status codes. |
| `PackagingConfiguration` | Metrics are shown only for the specified packaging configuration. Value: The autogenerated GUID of the configuration. Can be used alone or with other dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html) |
| `StatusCodeRange` | Metrics are shown for the specified status code range. Value: `2xx`, `3xx`, `4xx`, or `5xx`. Can be used alone or with other dimensions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediapackage/latest/ug/metrics-vod.html) |
# Monitoring AWS Elemental MediaPackage with CloudWatch Events
Amazon CloudWatch Events enables you to automate your AWS services and respond automatically to system events such as application availability issues or error conditions. AWS services deliver events to CloudWatch Events in near real-time. You can write simple rules to indicate which events are of interest to you, and what automated actions to take when an event matches a rule. The actions that can be automatically triggered include the following:
+ Invoking an AWS Lambda function
+ Invoking AWS Systems Manager Run Command
+ Relaying the event to Amazon Kinesis Data Streams
+ Activating an AWS Step Functions state machine
An example of using CloudWatch Events with MediaPackage is notifying an Amazon SNS topic if you reach the maximum stream input. MediaPackage emits events on a best effort basis.
For more information about creating rules in CloudWatch Events, see the [Amazon CloudWatch Events User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/).
For a list of events that MediaPackage emits, see [AWS Elemental MediaPackage events](cloudwatch-events-example.md).
# AWS Elemental MediaPackage events
AWS Elemental MediaPackage integrates with Amazon CloudWatch Events to notify you of certain events that affect your channels and endpoints. Each event is represented in [JSON (JavaScript Object Notation)](http://json.org) and contains the event name, the date and time when the event occurred, the channel or endpoint affected, and more. MediaPackage emits events on a best effort basis. You can use CloudWatch Events to collect these events and set up rules that route them to one or more *targets* such as AWS Lambda functions, Amazon SNS topics, Amazon SQS queues, streams in Amazon Kinesis Data Streams, or built-in targets.
For more information about using CloudWatch Events with other kinds of events, see the [Amazon CloudWatch Events User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/).
The following topics describe the CloudWatch Events that MediaPackage creates.
**Topics**
+ [
## Input notification events
](#input-state-events)
+ [
## Key provider notification events
](#key-provider-state-events)
+ [
## Harvest job notification events
](#hj-status-events)
## Input notification events
You get input notification events for live and video on demand (VOD) content. These events notify you when something happens with MediaPackage ingest. These are the input notification events you might receive:
+ Maximum input streams exceeded
+ Input switch
+ VOD ingest status change
+ VOD playback readiness
The following sections describe each of these events.
** Maximum Input Streams Exceeded Event **
For live content, a channel in MediaPackage exceeds the quota for the number of input streams. For information about quotas, see [Quotas in AWS Elemental MediaPackage](quotas.md).
**Example**
```
{
"id": "7bf73129-1428-4cd3-a780-95db273d1602",
"detail-type": "MediaPackage Input Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2015-11-11T21:29:54Z",
"region": "us-west-2",
"resources":[
"arn:aws:mediapackage:us-west-2:aws_account_id:channels/262ff182d46d4b399fcabea1364df682"
],
"detail":{
"event": "MaxIngestStreamsError",
"message": "Parent Manifest [%s] has [23] streams, more than [20] allowed: (index_1.m3u8,index_2.m3u8,index_3.m3u8,index_4.m3u8,index_5.m3u8,index_6.m3u8,index_7.m3u8,index_8.m3u8,index_9.m3u8,index_10.m3u8,index_11.m3u8,index_12.m3u8,index_13.m3u8,index_14.m3u8,index_15.m3u8,index_16.m3u8,index_17.m3u8,index_18.m3u8,index_19.m3u8,index_20.m3u8,index_21.m3u8,index_22.m3u8,index_23.m3u8)"
}
}
```
**Input Switch Event**
For live content, MediaPackage switches inputs for one of your endpoints.
One event is sent in a five-minute period. If the input switches multiple times in five minutes (for example, if MediaPackage switches to one input, then back to the other), you receive only one event.
For information about input redundancy and what causes inputs to switch, see [Live input redundancy AWS Elemental MediaPackage processing flow](what-is-flow-ir.md).
**Example**
```
{
"id": "8f9b8e72-0b31-e883-f19c-aec84742f3ce",
"detail-type": "MediaPackage Input Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2018-07-16T17:29:36Z",
"region": "us-east-1",
"resources":[
"arn:aws:mediapackage:us-east-1:aws_account_id:origin_endpoints/82d6b9bc04cb4612b487963d6c8d0f1a"
],
"detail":{
"event": "InputSwitchEvent",
"message": "Origin endpoint experienced an Input Switch Event",
"EventDetails": {
"Channel": "channel name",
"PreviousIngestEndpoint": "endpoint uuid before input switch",
"CurrentIngestEndpoint": "endpoint uuid after input switch",
}
}
}
```
**VOD Ingest Status Event**
For video on demand (VOD) content, an asset in MediaPackage changes ingest status. You get notifications for the following events:
+ `IngestStart`
+ `IngestError`
+ `IngestComplete`
**Example**
```
{
"id": "8f9b8e72-0b31-e883-f19c-aec84742f3ce",
"detail-type": "MediaPackage Input Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2019-05-03T17:29:36Z",
"region": "us-west-2",
"resources":[
"arn:aws:mediapackage-vod:us-west-2:aws_account_id:assets/asset_name"
],
"detail":{
"event": "IngestComplete",
"message": "message text"
}
}
```
**VOD Playback Event**
For VOD content, an asset in MediaPackage is available for playback. There is a period of time between when asset ingest is complete, and when the asset can be played back. The event `VodAssetPlayable` means that MediaPackage can now fulfill playback requests for the asset.
You get individual `VodAssetPlayable` events for each packaging configuration in your packaging group. For example, if your packaging group contains one DASH and one HLS packaging configuration, you receive two `VodAssetPlayable` events—one for your DASH packaging configuration, and one for your HLS packaging configuration.
**Example**
```
{
"id": "81e896e4-d9e5-ec79-f82a-b4cf3246c567",
"detail-type": "MediaPackage Input Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2019-11-03T21:46:00Z",
"region": "us-west-2",
"resources":[
"arn:aws:mediapackage-vod:us-west-2:aws_account_id:assets/asset_id",
"arn:aws:mediapackage-vod:us-west-2:aws_account_id:packaging_configuration/packaging_configuration_id"
],
"detail":{
"event": "VodAssetPlayable",
"message": "Asset 'asset_id' is now playable for PackagingConfiguration 'packaging_configuration_id'",
"packaging_configuration_id": "packaging_configuration_id",
"manifest_urls":[
"https://555555555555.egress.mediapackage-vod.us-west-2.amazonaws.com/out/v1/b9cc115bf7f1a/b848dfb116920772aa69ba/a3c74b1cae6a451c/index.m3u8"
]
}
}
{
"id": "91e896e4-d9e5-ab80-f82a-b4cf3246c568",
"detail-type": "MediaPackage Input Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2019-11-03T21:47:00Z",
"region": "us-west-2",
"resources":[
"arn:aws:mediapackage-vod:us-west-2:aws_account_id:assets/asset_id",
"arn:aws:mediapackage-vod:us-west-2:aws_account_id:packaging_configuration/packaging_configuration_id"
],
"detail":{
"event": "VodAssetPlayable",
"message": "Asset 'asset_id' is now playable for PackagingConfiguration 'packaging_configuration_id'",
"packaging_configuration_id": "packaging_configuration_id",
"manifest_urls":[
"https://111122223333.egress.mediapackage-vod.us-west-2.amazonaws.com/out/v1/1234567890abc/021345abcdef6789012345/abcdef0123456789/index.mpd"
]
}
}
```
## Key provider notification events
You get key provider notification events when you're using content encryption on an endpoint and MediaPackage can't reach the key provider. For information about DRM and encryption, see [https://docs.aws.amazon.com/speke/latest/documentation/](https://docs.aws.amazon.com/speke/latest/documentation/).
**Example Live key provider notification event**
```
{
"id": "7bf73129-1428-4cd3-a780-98ds273d1602",
"detail-type": "MediaPackage Key Provider Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2015-11-11T21:29:54Z",
"region": "us-west-2",
"resources":[
"arn:aws:mediapackage:us-west-2:aws_account_id:origin_endpoints/endpoint_id"
],
"detail":{
"event": "KeyProviderError",
"message": "message-text"
}
}
```
**Example VOD key provider notification event**
```
{
"id": "7bf73129-1428-4cd3-a780-98ds273d1602",
"detail-type": "MediaPackage Key Provider Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2015-11-11T21:29:54Z",
"region": "us-west-2",
"resources":[
"arn:aws:mediapackage-vod:us-west-2:aws_account_id:packaging_configurations/packaging_group_name"
],
"detail":{
"event": "KeyProviderError",
"message": "message-text"
}
}
```
## Harvest job notification events
You get harvest job status events when you export a clip from a live stream to create a live-to-VOD asset. MediaPackage creates notifications when the harvest job succeeds or fails. For information about harvest jobs and live-to-VOD assets, see [Creating live-to-VOD assets with AWS Elemental MediaPackage](ltov.md).
**Example Successful harvest job event**
```
{
"id": "8f9b8e72-0b31-e883-f19c-aec84742f3ce",
"detail-type": "MediaPackage HarvestJob Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2019-07-16T17:29:36Z",
"region": "us-east-1",
"resources":[
"arn:aws:mediapackage:us-east-1:aws_account_id:harvest_jobs/harvest_job_id"
],
"detail":{
"harvest_job": {
"id": "harvest_job_id",
"arn": "arn:aws:mediapackage-vod:us-east-1:aws_account_id:harvest_jobs/harvest_job_id",
"status": "SUCCEEDED",
"origin_endpoint_id": "endpoint_id",
"start_time": "2019-06-26T20:30:00-08:00",
"end_time": "2019-06-26T21:00:00-08:00",
"s3_destination": {
"bucket_name": "s3_bucket_name",
"manifest_key": "path/and/manifest_name/index.m3u8",
"role_arn": "arn:aws:iam::aws_account_id:role/S3Access_role",
},
"created_at": "2019-06-26T21:03:12-08:00"
}
}
}
```
**Example Failed harvest job event**
```
{
"id": "8f9b8e72-0b31-e883-f19c-aec84742f3ce",
"detail-type": "MediaPackage HarvestJob Notification",
"source": "aws.mediapackage",
"account": "aws_account_id",
"time": "2019-07-16T17:29:36Z",
"region": "us-east-1",
"resources":[
"arn:aws:mediapackage:us-east-1:aws_account_id:harvest_jobs/harvest_job_id"
],
"detail":{
"harvest_job": {
"id": "harvest_job_id",
"arn": "arn:aws:mediapackage-vod:us-east-1:aws_account_id:harvest_jobs/harvest_job_id",
"status": "FAILED",
"origin_endpoint_id": "endpoint_id",
"start_time": "2019-06-26T20:30:00-08:00",
"end_time": "2019-06-26T21:00:00-08:00",
"s3_destination": {
"bucket_name": "s3_bucket_name",
"manifest_key": "path/and/manifest_name/index.m3u8",
"role_arn": "arn:aws:iam::aws_account_id:role/S3Access_role",
},
"created_at": "2019-06-26T21:03:12-08:00"
},
"message": "Message text"
}
}
```
# Creating event notifications
You can use Amazon CloudWatch Events and Amazon Simple Notification Service (Amazon SNS) to notify you of new events. In CloudWatch Events, the rule describes which events you're notified about. In Amazon SNS, the topic describes what kind of notification you receive. This section provides high-level steps for creating a topic and rule for events from AWS Elemental MediaPackage. For detailed information about topics and rules, see the following:
+ [Create a topic](https://docs.aws.amazon.com/sns/latest/dg/sns-getting-started.html#CreateTopic) and [Subscribe to a topic](https://docs.aws.amazon.com/sns/latest/dg/sns-getting-started.html#SubscribeTopic) in the *Amazon Simple Notification Service Developer Guide*
+ [Getting started with Amazon CloudWatch Events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CWE_GettingStarted.html) in the *Amazon CloudWatch Events User Guide*
**To create notifications of CloudWatch events**
1. Access [Amazon SNS](https://console.aws.amazon.com/sns/v2/home) and create a topic. Give the topic a descriptive name that you will later recognize.
1. Subscribe to the topic that you just created. Choose what kind of notification you want to receive, and where that notification is sent. For example, for email notifications, choose the **Email** protocol and enter the email address to receive notifications for the endpoint.
1. Access [CloudWatch Events](https://console.aws.amazon.com/cloudwatch) and create a rule that uses a **Custom event pattern**. In the pattern preview space, enter the following:
```
{
"source": [
"aws.mediapackage"
],
"detail-type": [
"detail-type from event"
]
}
```
For `detail-type`, enter the value for the `detail-type` field from the event. You can use the following values for detail-type:
+ **MediaPackage Input Notification**
+ **MediaPackage Key Provider Notification**
For information about the event types, see [AWS Elemental MediaPackage events](cloudwatch-events-example.md).
**Example**
The following example rule creates notifications for all events on all detail-types.
```
{
"source": [
"aws.mediapackage"
],
"detail-type": [
"MediaPackage Input Notification",
"MediaPackage Key Provider Notification",
"MediaPackage HarvestJob Notification"
]
}
```
1. Add a target to the rule that you just created. Choose **SNS topic**, and then choose the topic that you created in step 1.
1. Configure the details of the rule, and give it a descriptive name. To start using the rule, make sure it's enabled, and then save it.
# Logging AWS Elemental MediaPackage API calls with AWS CloudTrail
Logging is available with only live workflows in AWS Elemental MediaPackage.
MediaPackage is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in MediaPackage. CloudTrail captures all API calls for MediaPackage as events. These include calls from the MediaPackage console and code calls to the MediaPackage API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for MediaPackage. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in **Event history**. Using the information collected by CloudTrail, you can determine the request that was made to MediaPackage, the IP address from which the request was made, who made the request, when it was made, and additional details.
To learn more about CloudTrail, see the [AWS CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/).
## AWS Elemental MediaPackage information in CloudTrail
CloudTrail is enabled on your AWS account when you create the account. When activity occurs in AWS Elemental MediaPackage, that activity is recorded in a CloudTrail event along with other AWS service events in **Event history**. You can view, search, and download recent events in your account. For more information, see [Viewing events with CloudTrail event history](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html).
For an ongoing record of events in your account, including events for MediaPackage, create a trail. A *trail* enables CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you create a trail in the console, the trail applies to all AWS Regions. The trail logs events from all AWS Regions in the AWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following:
+ [Overview for creating a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
+ [CloudTrail supported services and integrations](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html#cloudtrail-aws-service-specific-topics-integrations)
+ [Configuring Amazon SNS notifications for CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/getting_notifications_top_level.html)
+ [Receiving CloudTrail log files from multiple regions](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html) and [Receiving CloudTrail log files from multiple accounts](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html)
All MediaPackage actions are logged by CloudTrail and are documented in the [AWS Elemental MediaPackage API Reference](https://docs.aws.amazon.com/mediapackage/latest/apireference/). For example, calls to the `CreateChannel`, `CreateOriginEndpoint`, and `RotateIngestEndpointCredentials` operations generate entries in the CloudTrail log files.
Every event or log entry contains information about who generated the request. The identity information helps you determine the following:
+ Whether the request was made with root user or IAM user credentials
+ Whether the request was made with temporary security credentials for a role or federated user
+ Whether the request was made by another AWS service
For more information, see the [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html).
## Understanding AWS Elemental MediaPackage log file entries
A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.
The following example shows a CloudTrail log entry that demonstrates the `UpdateChannel` operation:
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "AssumedRole",
"principalId": "ABCDEFGHIJKL123456789",
"arn": "arn:aws:sts::444455556666:assumed-role/Admin/testUser",
"accountId": "444455556666",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2018-12-18T00:50:58Z"
},
"sessionIssuer": {
"type": "Role",
"principalId": "ABCDEFGHIJKL123456789",
"arn": "arn:aws:iam::444455556666:role/Admin",
"accountId": "444455556666",
"userName": "Admin"
}
}
},
"eventTime": "2018-12-18T00:50:59Z",
"eventSource": "mediapackage.amazonaws.com",
"eventName": "UpdateChannel",
"awsRegion": "us-west-2",
"sourceIPAddress": "203.0.113.17",
"userAgent": "aws-cli/1.15.71 Python/3.6.5 Darwin/17.7.0 botocore/1.10.70",
"requestParameters": {
"description": "updated cloudtrail description",
"id": "cloudtrail-test"
},
"responseElements": {
"description": "updated cloudtrail description",
"hlsIngest": {
"ingestEndpoints": [
{
"username": "***",
"url": "https://mediapackage.us-west-2.amazonaws.com/in/v2/8d0ca97840d94b18b37ad292c131bcad/8d0ca97840d94b18b37ad292c131bcad/channel",
"password": "***",
"id": "8d0ca97840d94b18b37ad292c131bcad"
},
{
"username": "***",
"url": "https://mediapackage.us-west-2.amazonaws.com/in/v2/8d0ca97840d94b18b37ad292c131bcad/9c17f979598543b9be24345d63b3ad30/channel",
"password": "***",
"id": "9c17f979598543b9be24345d63b3ad30"
}
]
},
"id": "cloudtrail-test",
"arn": "arn:aws:mediapackage:us-west-2:444455556666:channels/8d0ca97840d94b18b37ad292c131bcad"
},
"requestID": "fc158262-025e-11e9-8360-6bff705fbba5",
"eventID": "e9016b49-9a0a-4256-b684-eed9bd9073ab",
"readOnly": false,
"eventType": "AwsApiCall",
"recipientAccountId": "444455556666"
}
```
# Access logging
MediaPackage provides access logs that capture detailed information about requests sent to your MediaPackage channel or packaging group. MediaPackage generates *ingress access logs* for requests sent to the channel's input endpoints, and *egress access logs* for requests sent to your channel's endpoints or packaging group's assets. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses. You can use these access logs to analyze service performance and troubleshoot issues. They can also help you learn about your customer base and understand your MediaPackage bill.
Access logging is an optional feature of MediaPackage that's disabled by default. After you enable access logging, MediaPackage captures the logs and saves them to the CloudWatch log group that you specify when you create or manage access logging. Typical CloudWatch Logs charges apply.
**Topics**
+ [
## Permissions to publish access logs to CloudWatch
](#permissions)
+ [
## Enable access logging
](#enable-access-logging)
+ [
## Disable access logging
](#disable-access-logging)
+ [
## Access log format
](#access-log-format)
+ [
## Read the access logs
](#read-access-logs)
## Permissions to publish access logs to CloudWatch
When you enable access logging, MediaPackage creates an IAM service-linked role, `AWSServiceRoleForMediaPackage`, in your AWS account. This role allows MediaPackage to publish access logs to CloudWatch. For information about how MediaPackage uses service-linked roles, see [Using Service-Linked Roles for MediaPackage](using-service-linked-roles.md).
## Enable access logging
You can enable access logs using the AWS Management Console or the AWS CLI.
**To enable access logs for an existing channel using the console**
1. Open the MediaPackage console at [https://console.aws.amazon.com/mediapackage/](https://console.aws.amazon.com/mediapackage/).
1. Select your channel.
1. In the **Configure Access Logs** section, do the following:
1. Choose **Enable ingress access logs** or **Enable egress access logs**, or both.
1. You can specify a custom CloudWatch **Log group name**. If left blank, the default group is used.
**To enable access logs for an existing packaging group using the console**
1. Open the MediaPackage console at [https://console.aws.amazon.com/mediapackage/](https://console.aws.amazon.com/mediapackage/).
1. Select **Packaging groups** from the navigation section.
1. Choose your packaging group.
1. Select **Edit** in the navigation bar.
1. In the **Access logging** section, select **Enable egress access logs**.
1. You can specify a custom CloudWatch **Log group name**. If left blank, the default group is used.
1. Choose **Save changes**.
**To enable access logs for a channel using the AWS CLI**
Use the [configure-logs](https://docs.aws.amazon.com/cli/latest/reference/mediapackage/configure-logs.html) command with the `--ingress-access-logs` parameter, `--egress-access-logs` parameter, or both, to enable access logging. You can include a CloudWatch log group name for the `--ingress-access-logs` and `--egress-access-logs` parameters. If you don't specify a log group name, then the MediaPackage default log group is used. For ingress logs, the default log group is `/aws/MediaPackage/IngressAccessLogs`, and for egress logs the default log group is `/aws/MediaPackage/EgressAccessLogs`.
Use the following command to enable both ingress and access logs using the default log groups:
```
aws mediapackage configure-logs --id channel-name --ingress-access-logs {} --egress-access-logs {}
```
This command has no return value.
**To enable access logs for a packaging group using the AWS CLI**
Use the [configure-logs](https://docs.aws.amazon.com/cli/latest/reference/mediapackage-vod/configure-logs.html) command with the `--egress-access-logs` parameter to enable access logging. You can include a CloudWatch log group name for the `--egress-access-logs` parameter. If you don't specify a log group name, then the MediaPackage default log group is used. For ingress logs, the default log group is `/aws/MediaPackage/IngressAccessLogs`, and for egress logs the default log group is `/aws/MediaPackage/EgressAccessLogs`.
Use the following command to enable egress access logs using the default log groups:
```
aws mediapackage configure-logs --id package-name --egress-access-logs {}
```
This command has no return value.
## Disable access logging
You can disable access logs for your MediaPackage channel or packaging group at any time.
**To disable access logging using the console**
1. Open the MediaPackage console at [https://console.aws.amazon.com/mediapackage/](https://console.aws.amazon.com/mediapackage/).
Select your channel or package group.
1. Choose **Edit**.
1. In the **Access logging** section, deselect **Ingress access logging**, **Egress access logging**, or both.
1. Choose **Save changes**.
**To disable access logging for a channel using the AWS CLI**
Use the `configure-logs` command to disable access logging. If one or more of the access log parameters aren't declared with the `configure-logs` command, then the corresponding access logs are disabled. For example, in the following command egress access logs are enabled for a channel, and ingress access logs are disabled:
```
aws mediapackage configure-logs --id channel-name --egress-access-logs {}
```
This command has no return value.
**To disable access logging for a packaging group using the AWS CLI**
Use the `configure-logs` command to disable access logging. If one or more of the access log parameters aren't declared with the `configure-logs` command, then the corresponding access logs are disabled. For example, in the following command `configure-logs` doesn't include `--egress-access-logs` so egress logs are disabled:
```
aws mediapackage configure-logs --id package-group-name
```
This command has no return value.
## Access log format
The access log files consist of a sequence of JSON-formatted log records, where each log record represents one request. The order of the fields within the log can vary. The following is an example channel egress access log:
```
{
"timestamp": "2020-07-13T18:59:56.293656Z",
"clientIp": "192.0.2.0/24",
"processingTime": 0.445,
"statusCode": "200",
"receivedBytes": 468,
"sentBytes": 2587370,
"method": "GET",
"request": "https://aaabbbcccdddee.mediapackage.us-east-1.amazonaws.com:443/out/v1/75ee4f20e5df43e5821e5cb17ea19238/hls_7_145095.ts?m=1538005779",
"protocol": "HTTP/1.1",
"userAgent": "sabr/3.0 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Safari/528.17",
"account": "111122223333",
"channelId": "my_channel",
"channelArn": "arn:aws:mediapackage:us-west-2:111122223333:channels/ExampleChannelID",
"domainName": "aaabbbcccdddee.mediapackage.us-east-1.amazonaws.com",
"requestId": "aaaAAA111bbbBBB222cccCCC333dddDDD",
"endpointId": "my_endpoint",
"endpointArn": "arn:aws:mediapackage:us-west-2:111122223333:origin_endpoints/ExampleEndpointID"
}
```
The following list describes the log record fields, in order:
*timestamp*
The time of day when the request was received. The value is `ISO-8601` date time and is based on the system clock of the host that served the request.
*clientIp*
The IP address of the requesting client.
*processingTime*
The number of seconds that MediaPackage spent processing your request. This value is measured from the time the last byte of your request was received until the time the first byte of the response was sent.
*statusCode*
The numeric HTTP status code of the response.
*receivedBytes*
The number of bytes in the request body that the MediaPackage server receives.
*sentBytes*
The number of bytes in the response body that the MediaPackage server sends. This value often is the same as the value of the `Content-Length` header that's included with server responses.
*method*
The HTTP request method that was used for the request: DELETE, GET, HEAD, OPTIONS, PATCH, POST, or PUT.
*request*
The request URL.
*protocol*
The type of protocol used for the request, such as HTTP.
*userAgent*
A user-agent string that identifies the client that originated the request, enclosed in double quotes. The string consists of one or more product identifiers, product/version. If the string is longer than 8 KB, it is truncated.
*account*
The AWS account ID of the account that was used to make the request.
*channelId*
The ID of the channel that received the request.
*channelArn*
The Amazon Resource Name (ARN) of the channel that received the request.
*domainName*
The server name indication domain provided by the client during the TLS handshake, enclosed in double quotes. This value is set to `-` if the client doesn't support SNI or the domain doesn't match a certificate and the default certificate is presented to the client.
*requestId*
A string that's generated by MediaPackage to uniquely identify each request.
*endpointId*
The ID of the endpoint that received the request.
*endpointArn*
The Amazon Resource Name (ARN) of the endpoint that received the request.
The order of the fields in the log can vary.
## Read the access logs
MediaPackage writes the access logs to Amazon CloudWatch Logs. Typical CloudWatch Logs charges apply. Use CloudWatch Logs Insights to read the access logs. For information on how to use CloudWatch Logs Insights, see [Analyzing Log Data with CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html) in the *AWS CloudWatch Logs User Guide*.
**Note**
The access logs can take a few minutes to appear in CloudWatch. If you don't see the logs, wait a few minutes and try again.
### Examples
This section includes example queries that you can use to read MediaPackage debug log data.
**Example View the HTTP status code responses for a channel.**
Use this query to view the responses by HTTP status code for a channel. You can use this to view HTTP error code responses to help you to troubleshoot issues.
```
fields @timestamp, @message
| filter channelId like 'my-channel'
| stats count() by statusCode
```
**Example Get the number of requests per endpoint on a channel.**
```
fields @timestamp, @message
| filter channelId like 'my-channel'
| stats count() by endpointId
```
**Example View status codes per asset.**
```
fields @timestamp, @message
| filter assetArnlike 'my-asset-id'
| stats count() by statusCode
```
**Example Get the P99 response times for a packaging configuration over time**
```
fields @timestamp, @message
| filter packagingConfigArn like 'my-dash-config'
| stats pct(processingTime, 99) by bin(5m)
```
# Monitoring manifest update time
AWS Elemental MediaPackage playback responses include the following custom headers that indicate when MediaPackage last modified the manifest in non-dynamic ad insertion workflows. These headers are helpful when troubleshooting issues related to stale manifests.
## X-MediaPackage-Manifest-Last-Sequence
This is the highest segment sequence number in the manifest.
+ For DASH, this is the highest segment number in the lowest rendition of the manifest.
+ For HLS and CMAF, this is the highest segment number in the media playlist.
+ For MSS, this is the highest segment number in the manifest.
See the following section for [manifest examples](#manifest-examples).
## X-MediaPackage-Manifest-Last-Updated
The epoch timestamp in milliseconds when MediaPackage generates the segment referred to in `X-MediaPackage-Manifest-Last-Sequence`.
## Manifest examples
### DASH manifest examples
For both compact and full DASH manifests, MediaPackage determines the `X-MediaPackage-Manifest-Last-Sequence` value from the highest segment number in the lowest rendition of the manifest. The service calculates the `X-MediaPackage-Manifest-Last-Updated` value based on when it generates the segment referred to in `X-MediaPackage-Manifest-Last-Sequence`.
#### Number with duration - compact manifest
The following is an example of a compact DASH manifest that uses the number with duration template. MediaPackage determines the `X-MediaPackage-Manifest-Last-Sequence` value from the highest segment number in the lowest rendition in the manifest. For example, in the following manifest, the highest segment number is `index_video_5_0_175232.mp4`, so the value of `X-MediaPackage-Manifest-Last-Sequence` is `175232`. See [`duration` Attribute in the `SegmentTemplate`](segtemp-format-duration.md) for information about how MediaPackage calculates the sequence `$Number$` value. The value of `X-MediaPackage-Manifest-Last-Updated` is the epoch timestamp in milliseconds when MediaPackage generates the segment referred to in `X-MediaPackage-Manifest-Last-Sequence`.
```
```
#### Number with timeline - compact manifest
The following is an example of a compact DASH manifest that uses the number with timeline template. MediaPackage determines the `X-MediaPackage-Manifest-Last-Sequence` value from the highest segment number in the lowest rendition in the manifest. For example, in the following manifest, the highest segment number is `index_video_1_0_7.mp4`, so the value of `X-MediaPackage-Manifest-Last-Sequence` is `7`. The value of `X-MediaPackage-Manifest-Last-Updated` is the is the epoch timestamp in milliseconds when MediaPackage generates the segment referred to in `X-MediaPackage-Manifest-Last-Sequence`.
```
```
#### Number with timeline - compact manifest
The following is an example of a compact DASH manifest that uses the number with duration template. MediaPackage determines the `X-MediaPackage-Manifest-Last-Sequence` value from the highest segment number in the lowest rendition in the manifest. For example, in the following manifest, the highest segment number is `index_video_1_0_1675200.mp4`, so the value of `X-MediaPackage-Manifest-Last-Sequence` is `1675200`. See [`media` Attribute in `SegmentTemplate`](segtemp-format-media.md) for information about how MediaPackage calculates the sequence number. The value of `X-MediaPackage-Manifest-Last-Updated` is the is the epoch timestamp in milliseconds when MediaPackage generates the segment referred to in `X-MediaPackage-Manifest-Last-Sequence`.
```
```
### HLS manifest
MediaPackage determines the `X-MediaPackage-Manifest-Last-Sequence` value from the last segment in the manifest. For example, in the following manifest `index_1_3.ts` is the highest segment sequence number, so the value of `X-MediaPackage-Manifest-Last-Sequence` is `3`. The value of `X-MediaPackage-Manifest-Last-Updated` corresponds to the epoch timestamp in milliseconds when MediaPackage generates the last segment in the manifest.
```
#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:8
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:7.500,
index_1_0.ts?m=1583172400
#EXTINF:7.500,
index_1_1.ts?m=1583172400
#EXTINF:7.500,
index_1_2.ts?m=1583172400
#EXTINF:7.500,
index_1_3.ts?m=1583172400
#EXT-X-ENDLIST
```
### CMAF manifest
Similar to HLS, MediaPackage determines the `X-MediaPackage-Manifest-Last-Sequence` value from the last segment in the manifest. For example, in the following manifest `../cmafseg_video_1_10.mp4?m=1621616399` is the highest segment sequence number, so the value of `X-MediaPackage-Manifest-Last-Sequence` is `10`. The value of `X-MediaPackage-Manifest-Last-Updated` corresponds to the epoch timestamp in milliseconds when MediaPackage generates the last segment in the manifest.
```
#EXTM3U
#EXT-X-VERSION:6
#EXT-X-INDEPENDENT-SEGMENTS
#EXT-X-TARGETDURATION:12
#EXT-X-MEDIA-SEQUENCE:1
#EXT-X-MAP:URI="../cmafseg_video_1_track_1098178399_csid_aaa_2_init.mp4"
#EXTINF:11.250,
../cmafseg_video_1_1.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_2.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_3.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_4.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_5.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_6.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_7.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_8.mp4?m=1621616399
#EXTINF:11.250,
../cmafseg_video_1_9.mp4?m=1621616399
#EXTINF:0.542,
../cmafseg_video_1_10.mp4?m=1621616399
#EXT-X-ENDLIST
```
### MSS manifest
MediaPackage determines the `X-MediaPackage-Manifest-Last-Sequence` value from the highest segment in the manifest, as indicated by `Fragments(a_2_0={start time})`. For example, in the following manifest `Fragments(a_2_0=380533333)` is the highest sequence number, so the value of `X-MediaPackage-Manifest-Last-Sequence` is `380333333`. The value of `X-MediaPackage-Manifest-Last-Updated` corresponds to the epoch timestamp in milliseconds when MediaPackage generates the last segment in the manifest.
```
```
# Monitoring AWS media services with workflow monitor
Workflow monitor is a tool for the discovery, visualization, and monitoring of AWS media workflows. Workflow monitor is available in the AWS console and API. You can use workflow monitor to discover and create visual mappings of your workflow's resources, called *signal maps*. You can create and manage Amazon CloudWatch alarm and Amazon EventBridge rule templates to monitor the mapped resources. The monitoring templates you create are transformed into deployable AWS CloudFormation templates to allow repeatability. AWS recommended alarm templates provide predefined best-practice monitoring.
**Discover**
Utilize signal maps to automatically discover interconnected AWS resources associated with your media workflow. Discovery can begin at any supported service resource and creates an end-to-end mapping of the workflow. Signal maps can be used as stand-alone visualization tools or enhanced with monitoring templates.
![\[Workflow monitor discovery components.\]](http://docs.aws.amazon.com/mediapackage/latest/ug/images/workflowmonitor-discovery.png)
**Monitor**
You can create custom CloudWatch alarm and EventBridge rule templates to monitor the health and status of your media workflows. Best practice alarm templates are available to import into your workflow monitor environment. You can use the best practice alarm templates as they are, or edit them to better fit your workflow. Any templates you create are transformed into CloudFormation templates for repeatable deployment.
![\[Workflow monitor monitoring components.\]](http://docs.aws.amazon.com/mediapackage/latest/ug/images/workflowmonitor-monitoring.png)
**Note**
There is no direct cost for using workflow monitor. However, there are costs associated with the resources created and used to monitor your workflow.
When monitoring is deployed, Amazon CloudWatch and Amazon EventBridge resources are created. When using the AWS Management Console, prior to deploying monitoring to a signal map, you will be notified of how many resources will be created. For more information about pricing, see: [CloudWatch pricing](https://aws.amazon.com/cloudwatch/pricing/) and [EventBridge pricing](https://aws.amazon.com/eventbridge/pricing/).
Workflow monitor uses AWS CloudFormation templates to deploy the CloudWatch and EventBridge resources. These templates are stored in a standard class Amazon Simple Storage Service bucket that is created on your behalf, by workflow monitor, during the deployment process and will incur object storage and recall charges. For more information about pricing, see: [Amazon S3 pricing](https://aws.amazon.com/s3/pricing/).
Previews generated in the workflow monitor signal map for AWS Elemental MediaPackage channels are delivered from the MediaPackage Origin Endpoint and will incur Data Transfer Out charges. For pricing, see: [MediaPackage pricing](https://aws.amazon.com/mediapackage/pricing/).
## Components of workflow monitor
Workflow monitor has four major components:
+ CloudWatch alarm templates - Define the conditions you would like to monitor using CloudWatch. You can create your own alarm templates, or import predefined templates created by AWS. For more information, see: [CloudWatch alarm groups and templates for monitoring your AWS media workflow](monitor-with-workflow-monitor-configure-alarms.md)
+ EventBridge rule templates - Define how EventBridge sends notifications when an alarm is triggered. For more information, see: [EventBridge rule groups and templates for monitoring your AWS media workflow](monitor-with-workflow-monitor-configure-notifications.md)
+ Signal maps - Use an automated process to create AWS Elemental workflow maps using existing AWS resources. The signal maps can be used to discover resources in your workflow and deploy monitoring to those resources. For more information, see: [Workflow monitor signal maps](monitor-with-workflow-monitor-configure-signal-maps.md)
+ Overview - The overview page allows you to directly monitor the status of multiple signal maps from one location. Review metrics, logs, and alarms for your workflows. For more information, see: [Workflow monitor overview](monitor-with-workflow-monitor-operate-overview.md)
## Supported services
Workflow monitor supports automatic discovery and signal mapping of resources associated with the following services:
+ AWS Elemental MediaConnect
+ AWS Elemental MediaLive
+ AWS Elemental MediaPackage
+ AWS Elemental MediaTailor
+ Amazon S3
+ Amazon CloudFront
**Topics**
+ [
## Components of workflow monitor
](#monitor-with-workflow-monitor-components)
+ [
## Supported services
](#monitor-with-workflow-monitor-supported-services)
+ [
# Configuring workflow monitor to monitor AWS media services
](monitor-with-workflow-monitor-configure.md)
+ [
# Using workflow monitor
](monitor-with-workflow-monitor-operate.md)
# Configuring workflow monitor to monitor AWS media services
To setup workflow monitor for the first time; you create the alarm and event templates, and discover signal maps that are used to monitor your media workflows. The following guide contains the steps necessary to setup both Administrator and Operator level IAM roles, create workflow monitor resources, and deploy monitoring to your workflows.
**Topics**
+ [
# Getting started with workflow monitor
](monitor-with-workflow-monitor-configure-getting-started.md)
+ [
# Workflow monitor groups and templates
](monitor-with-workflow-monitor-configure-templates.md)
+ [
# Workflow monitor signal maps
](monitor-with-workflow-monitor-configure-signal-maps.md)
+ [
# Workflow monitor quotas
](monitor-with-workflow-monitor-configure-quotas.md)
# Getting started with workflow monitor
The following steps provide a basic overview of using workflow monitor for the first time.
1. Setup workflow monitor IAM permissions for administrator and operator level roles: [Workflow monitor IAM policies](monitor-with-workflow-monitor-configure-getting-started-IAM.md)
1. Build alarm templates or import predefined templates created by AWS: [CloudWatch alarms](monitor-with-workflow-monitor-configure-alarms.md)
1. Build notification events that will be delivered by EventBridge: [EventBridge rules ](monitor-with-workflow-monitor-configure-notifications.md)
1. Discover signal maps using your existing AWS Elemental resources: [Signal maps ](monitor-with-workflow-monitor-configure-signal-maps.md)
1. Attach the alarm templates and notification rules to your signal map: [Attaching templates](monitor-with-workflow-monitor-configure-signal-maps-attach.md)
1. Deploy the templates to begin monitoring the signal map: [Deploying monitoring templates](monitor-with-workflow-monitor-configure-deploy.md)
1. Monitor and review your workflow monitor resources using the overview section of the AWS console: [Overview](monitor-with-workflow-monitor-operate-overview.md)
![\[The individual steps of setting up workflow monitor. Begin by creating the IAM roles. Next, create templates for alarms and events. Next, discover a signal map and attach your templates to the map. After a signal map has templates attached, the templates must be deployed. The final step is monitoring using the templates and overview resources.\]](http://docs.aws.amazon.com/mediapackage/latest/ug/images/workflowmonitor-overview-steps.png)
# Workflow monitor IAM policies
Workflow monitor interacts with multiple AWS services to create signal maps, build CloudWatch and EventBridge resources, and CloudFormation templates. Because workflow monitor interacts with a wide range of services, specific AWS Identity and Access Management (IAM) policies must be assigned for these services. The following examples indicate the necessary IAM policies for both administrator and operator IAM roles.
## Administrator IAM policy
The following example policy is for an administrator-level workflow monitor IAM policy. This role allows for the creation and management of workflow monitor resources and the supported service resources that interact with workflow monitor.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudwatch:List*",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:PutAnomalyDetector",
"cloudwatch:PutMetricData",
"cloudwatch:PutMetricAlarm",
"cloudwatch:PutCompositeAlarm",
"cloudwatch:PutDashboard",
"cloudwatch:DeleteAlarms",
"cloudwatch:DeleteAnomalyDetector",
"cloudwatch:DeleteDashboards",
"cloudwatch:TagResource",
"cloudwatch:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*",
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudfront:List*",
"cloudfront:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeNetworkInterfaces"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"events:List*",
"events:Describe*",
"events:CreateEventBus",
"events:PutRule",
"events:PutTargets",
"events:EnableRule",
"events:DisableRule",
"events:DeleteRule",
"events:RemoveTargets",
"events:TagResource",
"events:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"logs:Describe*",
"logs:Get*",
"logs:TagLogGroup",
"logs:TagResource",
"logs:UntagLogGroup",
"logs:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediaconnect:List*",
"mediaconnect:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"medialive:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage:List*",
"mediapackage:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackagev2:List*",
"mediapackagev2:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage-vod:List*",
"mediapackage-vod:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediatailor:List*",
"mediatailor:Describe*",
"mediatailor:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resource-groups:ListGroups",
"resource-groups:GetGroup",
"resource-groups:GetTags",
"resource-groups:GetGroupQuery",
"resource-groups:GetGroupConfiguration",
"resource-groups:CreateGroup",
"resource-groups:UngroupResources",
"resource-groups:GroupResources",
"resource-groups:DeleteGroup",
"resource-groups:UpdateGroupQuery",
"resource-groups:UpdateGroup",
"resource-groups:Tag",
"resource-groups:Untag"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": "arn:aws:s3:::workflow-monitor-templates*"
},
{
"Effect": "Allow",
"Action": [
"sns:TagResource",
"sns:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"tag:Get*",
"tag:Describe*",
"tag:TagResources",
"tag:UntagResources"
],
"Resource": "*"
}
]
}
```
------
## Operator IAM policy
The following example policy is for an operator-level workflow monitor IAM policy. This role allows for limited and read-only access to the workflow monitor resources and the supported service resources that interact with workflow monitor.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudwatch:List*",
"cloudwatch:Describe*",
"cloudwatch:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudfront:List*",
"cloudfront:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeNetworkInterfaces"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"events:List*",
"events:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"logs:Describe*",
"logs:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediaconnect:List*",
"mediaconnect:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"medialive:List*",
"medialive:Get*",
"medialive:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage:List*",
"mediapackage:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackagev2:List*",
"mediapackagev2:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage-vod:List*",
"mediapackage-vod:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediatailor:List*",
"mediatailor:Describe*",
"mediatailor:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": "arn:aws:s3:::workflow-monitor-templates*"
},
{
"Effect": "Allow",
"Action": [
"tag:Get*",
"tag:Describe*"
],
"Resource": "*"
}
]
}
```
------
# Workflow monitor groups and templates
Before you can deploy workflow monitoring to a signal map, you must create the groups and templates for CloudWatch alarms and EventBridge notifications. The CloudWatch templates define what scenarios and thresholds will be used to trigger the alarms. The EventBridge templates will determine how these alarms are reported to you.
If you only want mappings of your connected resources and do not want to use the monitoring template capabilities of workflow monitor, signal maps can be used without CloudWatch and EventBridge templates. For more information about using signal maps, see: [Signal maps ](monitor-with-workflow-monitor-configure-signal-maps.md)
**Topics**
+ [
# CloudWatch alarm groups and templates for monitoring your AWS media workflow
](monitor-with-workflow-monitor-configure-alarms.md)
+ [
# EventBridge rule groups and templates for monitoring your AWS media workflow
](monitor-with-workflow-monitor-configure-notifications.md)
# CloudWatch alarm groups and templates for monitoring your AWS media workflow
Workflow monitor alarms allow you to use existing CloudWatch metrics as the foundation of alarms for your signal maps. You can create an alarm template group to sort and classify the types of alarming that is important to your workflow. Within each alarm template group, you create alarm templates with specific CloudWatch metrics and parameters that you want to monitor. You can create your own alarm templates or import recommended alarm templates created by AWS. After creating an alarm template group and alarm templates within that group, you can attach one or more of these alarm template groups to a signal map.
You must create an alarm template group first. After you have created an alarm template group, you can create your own templates or use recommended templates created by AWS. If you want to create your own alarm templates, continue on this page. For more information about importing recommended templates, see: [Recommended templates](monitor-with-workflow-monitor-configure-alarms-recommended-templates.md)
This section covers the creation of CloudWatch alarms using workflow monitor. For more information about how the CloudWatch service handles alarms and details of the alarm components, see: [Using CloudWatch alarms](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html) in the *Amazon CloudWatch User Guide*
## Creating alarm template groups
Alarm template groups allow you to sort and classify the types of alarms that are important to your workflow.
**To create an alarm template group**
1. From the workflow monitor console's navigation pane, select **CloudWatch alarm templates**.
1. Select **Create alarm template group**.
1. Give the alarm template group a unique **Group name** and optional **Description**.
1. Select **Create**, You will be taken to the newly created alarm template group's details page.
## Creating alarm templates
You can create alarm templates with the CloudWatch metrics and parameters that you want to monitor.
**To create an alarm template**
1. From the alarm template group's details page, select **Create alarm template**.
1. Give the alarm template a unique **Template name** and optional **Description**.
1. In the **Choose metric** section:
1. Select a **Target Resource Type**. The target resource type is a resource for the respective service, such as a channel for MediaLive and MediaPackage or a flow for MediaConnect.
1. Select a **Metric Name**. This is the CloudWatch metric that acts as the foundation for the alarm. The list of metrics will change depending on the selected **Target Resource Type**.
1. In the **Alarm settings** section:
**Note**
For more information about how the CloudWatch service handles alarms and details of the alarm components, see: [Using CloudWatch alarms](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html) in the *Amazon CloudWatch User Guide*
1. Select the **Statistic**. This is a value such as a **Sum** or an **Average** that will be used to monitor the metric.
1. Select the **Comparison Operator**. This field references the **Threshold** that you set in the next step.
1. Set a **Threshold**. This is a numeric value that the **Comparison Operator** uses to determine greater than, less than, or equal to status.
1. Set a **Period**. This is a time value, in seconds. The **Period** is the length of time that the **Statistic**, **Comparison Operator**, and **Threshold** interact to determine if the alarm gets triggered.
1. Set the **Datapoints**. This value determines how many datapoints are needed to trigger the alarm.
1. Select how to **Treat Missing Data**. This selection determines how this alarm reacts to missing data.
1. Select **Create** to complete the process.
An example of a completed alarm template could have the following parameters: A MediaConnect flow **Target Resource Type** is monitored for the Disconnections **Metric Name**. The **Statistic** value is set to Sum with a **Comparison Operator** of "greater than or equal to" and a **Threshold** of 10. The **Period** is set to 60 seconds, and only requires 1 out of 1 **Datapoints**. **Treat Missing Data** is set to "ignore."
The result of these settings is: workflow monitor will monitor for disconnections on the flow. If 10 or more disconnections occur within 60 seconds, the alarm will be triggered. 10 or more disconnections in 60 seconds only needs to happen one time for the alarm to be triggered.
# Recommended alarm templates for monitoring your AWS media workflow
Workflow monitor's recommended templates are a curated selection of AWS Elemental service metrics with predefined alarm settings appropriate for the metric. If you do not want to create customized alarm templates, recommended templates provide you with best-practice monitoring templates that are created by AWS.
Workflow monitor contains recommended template groups for each supported service. These groups are designed to apply best-practice monitoring to specific types of workflows. Each template group contains a curated selection of alarms configured from service-specific metrics. For example, a recommended template group for a MediaLive multiplex workflow will have a different set of preconfigured metrics than a MediaConnect CDI workflow.
**To use recommended alarm templates**
1. Follow the steps to [create an alarm template group](monitor-with-workflow-monitor-configure-alarms.md#monitor-with-workflow-monitor-alarms-groups-create), or select an existing one.
1. In the **Alarm templates** section, select **Import**. You will need to import the AWS recommended templates into your template group.
1. Use the **CloudWatch alarm template groups** dropdown to select an AWS recommended group. These groups contain curated alarms for specific services.
1. Select the templates to import using the check boxes. Each template will list its metrics, preconfigured monitoring values, and provide a description of the metric. When you are done selecting templates, select the **Add** button.
1. The selected templates will move to the **Alarm template(s) to import** section. Review your choices and select **Import**.
1. After the import is complete, the selected templates will be added to the template group. If you want to add more templates, repeat the import process.
1. Imported templates can be customized after import. Alarm settings can be modified to fit your alarming needs.
# EventBridge rule groups and templates for monitoring your AWS media workflow
CloudWatch uses Amazon EventBridge rules to send notifications. You begin by creating an event template group. In that event template group, you create event templates that determine what conditions create a notification and who is notified.
This section covers the creation of EventBridge rules using workflow monitor. For more information about how the EventBridge service uses rules, see: [EventBridge rules](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-rules.html) in the *Amazon EventBridge User Guide*
## Creating event template groups
Event template groups allow you to sort and classify events based on your use case.
**To create an event template group**
1. From the workflow monitor console's navigation pane, select **EventBridge rule templates**.
1. Select **Create event template group**.
1. Give the alarm template group a unique **Group name** and optional **Description**.
1. Select **Create**, You will be taken to the newly created alarm template group's details page.
## Creating event templates
You can send notifications based on event templates you create.
**To create an event template**
1. From the event template group's details page, select **Create event template**.
1. Give the event template a unique **Template name** and optional **Description**.
1. In the **Rule settings** section:
1. Select an **Event type**. When selecting an event type, you can choose between several events created by AWS or select **Signal map active alarm** to use an alarm created by an alarm template.
1. Select a **Target service**. This determines how you would like to be notified of this event. You can select Amazon Simple Notification Service or CloudWatch logs.
1. After selecting a target service, select a **Target**. This will be a Amazon SNS topic or a CloudWatch log group, depending on your target service selection.
1. Select **Create** to complete the process.
# Workflow monitor signal maps
Signal maps are visual mappings of AWS resources in your media workflow. You can use workflow monitor to start the signal map discovery on any of the supported resource types. During the discovery process, workflow monitor will automatically and recursively map all connected AWS resources. After the signal map has been created, you can use the workflow monitor console to do things like deploy monitoring templates, view metrics, and view details of the mapped resources.
**Topics**
+ [
# Creating signal maps for AWS media workflows
](monitor-with-workflow-monitor-configure-signal-maps-create.md)
+ [
# Viewing signal maps of AWS media workflows
](monitor-with-workflow-monitor-configure-signal-maps-view.md)
+ [
# Attaching alarm and event templates to the signal map of your AWS media workflow
](monitor-with-workflow-monitor-configure-signal-maps-attach.md)
+ [
# Deploying templates to the signal map of your AWS media workflow
](monitor-with-workflow-monitor-configure-deploy.md)
+ [
# Updating the signal map of your AWS media workflow
](monitor-with-workflow-monitor-configure-signal-maps-update.md)
+ [
# Deleting the signal map of your AWS media workflow
](monitor-with-workflow-monitor-configure-signal-maps-delete.md)
# Creating signal maps for AWS media workflows
You can use workflow monitor signal maps to create a visual mapping of all connected AWS resources in your media workflow.
**To create a signal map**
1. From the workflow monitor console's navigation pane, select **Signal maps**.
1. Select **Create signal map**.
1. Give the signal map a **Name** and **Description**.
1. In the **Discover new signal map** section, resources in the current account and selected region are displayed. Select a resource to begin signal map discovery. The selected resource will be the starting point for discovery.
1. Select **Create**. Allow a few moments for the discovery process to complete. After the process is complete, you will be presented with the new signal map.
**Note**
Previews generated in the workflow monitor signal map for AWS Elemental MediaPackage channels are delivered from the MediaPackage Origin Endpoint and will incur Data Transfer Out charges. For pricing, see: [MediaPackage pricing](https://aws.amazon.com/mediapackage/pricing/).
# Viewing signal maps of AWS media workflows
Workflow monitor signal maps allow you to see a visual mapping of all connected AWS resources in your media workflow.
**Signal map views**
After selecting a signal map, you have two views that can be used to monitor or configure the signal map. **Monitor signal map** and **Configure signal map** is a context-sensitive button found in the upper-right of the signal map console section.
If you select the signal map using the **Signal maps** section of the navigation pane, your signal map will be displayed in the configuration view. The configuration view allows you to make changes to the template groups attached to this signal map, deploy the attached templates, and view the basic details and tags of the signal map.
If you select the signal map using the **Overview** section of the navigation pane, your signal map will be displayed in monitoring view. The monitoring view displays the CloudWatch alarms, EventBridge rules, alerts, logs, and metrics for this signal map.
The view can be changed at any time by selecting the **Monitor/Configure signal map** button in the upper-right. The configuration view requires administrator-level IAM permissions. Required IAM permissions can be viewed here: [Workflow monitor IAM policies](monitor-with-workflow-monitor-configure-getting-started-IAM.md)
**Navigating the signal map**
A signal map will contain nodes for every supported AWS resource discovered by workflow monitor. Certain resources, such as MediaLive channels and MediaPackage endpoints can display thumbnail previews of the content, if thumbnail previews are available.
Selecting a resource node, and selecting **View selected resource details** from the **Actions** dropdown menu will take you to the associated service's details page. For example, selecting a MediaLive channel and selecting **View selected resource details** will open the MediaLive console's details page for that channel.
Selecting a resource node will filter the list of active alarms to only that node. If you select the resource's **Target ARN** in the active alarm, you will be taken to the associated service's details page, with the selected resource open.
# Attaching alarm and event templates to the signal map of your AWS media workflow
After you have created alarm and event templates, you need to attach these to a signal map. Any of the alarm and event templates you have created can be attached to any discovered signal maps.
**To attach alarm and event templates to your signal map**
1. From the workflow monitor console's navigation pane, select **Signal maps** and select the signal map you want to work with.
1. In the upper-right of the signal map page, in the **CloudWatch alarm template groups** tab, select **Attach CloudWatch alarm template groups**.
1. In the new section that opens, choose all of the alarm template groups that you want to apply to this signal map, then select **Add**. This will cause the selected alarm template groups to move to the **Attached CloudWatch alarm template groups** section.
1. Selecting **Save** will save your changes and return you to the signal map page.
1. At the right of the signal map page, select the **EventBridge rule template groups** tab then select **Attach EventBridge rule template groups**.
1. In the new section that opens, choose all of the event template groups that you want to apply to this signal map, then select **Add**. This will cause the selected rule template groups to move to the **Attached EventBridge rule template groups** section.
1. Selecting **Save** will save your changes and return you to the signal map page.
1. You have assigned CloudWatch alarm and EventBridge rule templates to the signal map, but the monitoring is not yet deployed. The next section will cover the deployment of the monitoring resources.
# Deploying templates to the signal map of your AWS media workflow
After you have attached the alarm and event templates to your signal map, you must deploy the monitoring. Until the deployment is complete, the monitoring of your signal map will not be active.
Workflow monitor will only deploy alarms that are relevant to the selected signal map. For example, the attached alarm template group might contain alarms for multiple services, such as MediaLive, MediaPackage, and MediaConnect. If the selected signal map only contains MediaLive resources, no MediaPackage or MediaConnect alarms will be deployed.
**To deploy the monitoring templates**
1. After attaching alarm and event template groups to your signal map and saving your changes, select **Deploy monitor** in the **Actions** dropdown menu.
1. You will be asked to confirm the deployment and presented with the number of CloudWatch and EventBridge resources that will be created. If you would like to proceed, select **Deploy**.
**Note**
There is no direct cost for using workflow monitor. However, there are costs associated with the resources created and used to monitor your workflow.
When monitoring is deployed, Amazon CloudWatch and Amazon EventBridge resources are created. When using the AWS Management Console, prior to deploying monitoring to a signal map, you will be notified of how many resources will be created. For more information about pricing, see: [CloudWatch pricing](https://aws.amazon.com/cloudwatch/pricing/) and [EventBridge pricing](https://aws.amazon.com/eventbridge/pricing/).
Workflow monitor uses AWS CloudFormation templates to deploy the CloudWatch and EventBridge resources. These templates are stored in a standard class Amazon Simple Storage Service bucket that is created on your behalf, by workflow monitor, during the deployment process and will incur object storage and recall charges. For more information about pricing, see: [Amazon S3 pricing](https://aws.amazon.com/s3/pricing/).
1. The status of the deployment is displayed next to the name of the signal map. The deployment status is also visible in the **Stacks** section of the CloudFormation console. After a few moments of resource creation and deployment, your signal map monitoring will begin.
# Updating the signal map of your AWS media workflow
If a change is made to your workflow, you might need to rediscover the signal map and redeploy monitoring resources. Workflow monitor is a visualization and monitoring tool that does not have the ability to make any changes to your workflow. Signal maps represent a point-in-time visualization of your workflow. In the event that you add, remove, or significantly modify parts of your media workflow, we recommend that you rediscover the signal map. If you have monitoring resources attached to the signal map, we recommend you redeploy monitoring after the rediscovery process.
**To rediscover a signal map**
1. From the workflow monitor console's navigation pane, select **Signal maps** and select the signal map you want to work with.
1. Verify that you are in the **Configure signal map** view. For more information about changing views, see: [Viewing signal maps ](monitor-with-workflow-monitor-configure-signal-maps-view.md)
1. In the upper-right of the signal map page, select the **Actions** dropdown menu. Select **Rediscover**.
1. You will be presented with the rediscovery screen. Select a resource that is a part of the workflow you are rediscovering. Select the **Rediscover** button.
1. The signal map will be rebuilt according to the current workflow. If you need to redeploy monitoring resources, stay on this signal map's page. Any previously attached monitoring templates will remain attached, but will need to be redeployed.
**To redeploy monitoring templates after a signal map rediscovery**
1. After the rediscovery, you will be directed to the updated signal map. To redeploy the monitoring templates, select **Deploy monitor** from the **Actions** dropdown menu.
1. You will be asked to confirm the deployment and presented with the number of any CloudWatch and EventBridge resources that will be created. If you would like to proceed, select **Deploy**.
1. The status of the deployment is displayed next to the name of the signal map. After a few moments of resource creation and deployment, your signal map monitoring will begin.
# Deleting the signal map of your AWS media workflow
If you not longer need a signal map, it can be deleted. If you have monitoring templates deployed on the signal map, the deletion process will ask you to delete any CloudWatch and EventBridge resources that have been deployed to this signal map. Deleting the deployed resources does not affect the templates that created them. This resource deletion is to ensure that you do not have CloudWatch and EventBridge resources that are deployed but not used.
**To delete a signal map**
1. From the workflow monitor console's navigation pane, select **Signal maps** and select the radio button next to the signal map you want to delete.
1. Select the **Delete** button. You will be asked to confirm the deletion of the monitoring resources. Select **Delete** to begin the monitoring resource deletion process.
1. The **Monitor deployment** column will display the current status. When the status has changed to **DELETE\$1COMPLETE**, select the **Delete** button again.
1. You will be asked to confirm deletion of the signal map. Select **Delete** to proceed and delete the signal map.
# Workflow monitor quotas
The following section contains quotas for workflow monitor resources. Each quota is on a "per account" basis. If you need to increase a quota for your account, you can use the [AWS Service Quotas console](https://console.aws.amazon.com/servicequotas/home) to request an increase, unless otherwise noted in the following table.
**Quotas**
| Resource type | Quota |
| --- | --- |
| CloudWatch alarm template groups | 20 |
| CloudWatch alarm templates | 200 |
| EventBridge rule template groups | 20 |
| EventBridge rule templates | 200 |
| Signal maps | 30 |
| Signal maps: CloudWatch alarm template groups attached to a single signal map | 5You cannot increase this quota. |
| Signal maps: EventBridge rule template groups attached to a single signal map | 5You cannot increase this quota. |
# Using workflow monitor
Use the **overview** and **signal maps** sections of the workflow monitor console to review the current status of the workflows and any associated alarms, metrics, and logs.
**Topics**
+ [
# Workflow monitor overview
](monitor-with-workflow-monitor-operate-overview.md)
+ [
# Overview logs and metrics for workflow monitor
](monitor-with-workflow-monitor-operate-logs-metrics.md)
+ [
# Using workflow monitor signal maps
](monitor-with-workflow-monitor-operate-signal-maps.md)
# Workflow monitor overview
The **Overview** section of the workflow monitor console is a dashboard that provides at-a-glance information about your signal maps. In the overview section, you can see the current state of each signal map's monitoring, as well as CloudWatch metrics and any associated CloudWatch logs. You can select any signal map to be taken to that signal maps console page.
**Overview filtering**
Using the **Search** bar in the overview section, you can filter the list of signal maps using context sensitive constraints. After selecting the search bar, you will be presented with a list of **Properties** to filter by. Selecting a property will present **Operators** such as Equals, Contains, Does not equal, and Does not contain. Selecting an operator will create a list of resources from the selected property type. Selecting one of these resources will cause the signal map list to only display signal maps that fit the constraint you defined.
# Overview logs and metrics for workflow monitor
To view CloudWatch metrics and logs for a signal map, select the radio button next to the name of the signal map. A tabbed interface for both metrics and logs will appear beneath the signal map list.
**CloudWatch Metrics**
CloudWatch metrics for the selected signal map will be context-sensitive and only display metrics associated with the services used in that signal maps workflow. You can use the on-screen metrics tools to customize the displayed metric periods and time ranges.
**CloudWatch Logs **
If you associated a CloudWatch log group with the signal map, that group will be displayed here.
# Using workflow monitor signal maps
From the **overview** section of the console, you can select a specific signal map to view more information about that signal map and its attached monitoring resources.
After selecting a signal map, you will be presented with the signal map and a number of tabbed section containing more information:
+ CloudWatch alarms
+ EventBridge rules
+ AWS Elemental alerts
+ Metrics
+ Logs
+ Basic details
**Navigating the signal map**
A signal map will contain nodes for every supported AWS resource discovered by workflow monitor. Certain resources, such as MediaLive channels and MediaPackage endpoints can display thumbnail previews of the content, if thumbnail previews are available.
Selecting a resource node, and selecting **View selected resource details** from the **Actions** dropdown menu will take you to the associated service's details page. For example, selecting a MediaLive channel and selecting **View selected resource details** will open the MediaLive console's details page for that channel.
Selecting a resource node will filter the list of active alarms to only that node. If you select the resource's **Target ARN** in the active alarm, you will be taken to the associated service's details page, with the selected resource open.