如何使用 Lambda 通过 CloudWatch 获取 EC2 信息？

Question

以下流程正在执行 Lambda。

1. 使用 cloudwatch 日志监控 EC2 中的日志文件
2. 使用指标过滤器检测受监控的字符串
3. 使用警报执行 Lambda

我想知道如何在 Lambda 中获取以下信息。

• 正在监视的日志文件的路径
• 实例名称
• 实例ID
• 警报名称

我正在用python编写并尝试使用boto3获取它。

Answer 1

您可以通过 2 种方式轻松实现此目的：-

1. 创建事件类型为 cloudwatch 的 cloudwatch 事件桥接规则
   报警状态改变。

• 每当您的警报处于警报状态时，它都会发送一个事件，将此事件类型的目标配置为 lambda 函数或 sns 主题，无论您需要什么。

此规则的示例事件

{
  "version": "0",
  "id": "c4c1c1c9-6542-e61b-6ef0-8c4d36933a92",
  "detail-type": "CloudWatch Alarm State Change",
  "source": "aws.cloudwatch",
  "account": "123456789012",
  "time": "2019-10-02T17:04:40Z",
  "region": "us-east-1",
  "resources": ["arn:aws:cloudwatch:us-east-1:123456789012:alarm:ServerCpuTooHigh"],
  "detail": {
    "alarmName": "ServerCpuTooHigh",
    "configuration": {
      "description": "Goes into alarm when server CPU utilization is too high!",
      "metrics": [{
        "id": "30b6c6b2-a864-43a2-4877-c09a1afc3b87",
        "metricStat": {
          "metric": {
            "dimensions": {
              "InstanceId": "i-12345678901234567"
            },
            "name": "CPUUtilization",
            "namespace": "AWS/EC2"
          },
          "period": 300,
          "stat": "Average"
        },
        "returnData": true
      }]
    },
    "previousState": {
      "reason": "Threshold Crossed: 1 out of the last 1 datapoints [0.0666851903306472 (01/10/19 13:46:00)] was not greater than the threshold (50.0) (minimum 1 datapoint for ALARM -> OK transition).",
      "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-01T13:56:40.985+0000\",\"startDate\":\"2019-10-01T13:46:00.000+0000\",\"statistic\":\"Average\",\"period\":300,\"recentDatapoints\":[0.0666851903306472],\"threshold\":50.0}",
      "timestamp": "2019-10-01T13:56:40.987+0000",
      "value": "OK"
    },
    "state": {
      "reason": "Threshold Crossed: 1 out of the last 1 datapoints [99.50160229693434 (02/10/19 16:59:00)] was greater than the threshold (50.0) (minimum 1 datapoint for OK -> ALARM transition).",
      "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-02T17:04:40.985+0000\",\"startDate\":\"2019-10-02T16:59:00.000+0000\",\"statistic\":\"Average\",\"period\":300,\"recentDatapoints\":[99.50160229693434],\"threshold\":50.0}",
      "timestamp": "2019-10-02T17:04:40.989+0000",
      "value": "ALARM"
    }
  }
}

2. 在您的云手表警报中有一个警报操作，您可以向其中添加 SNS 主题，然后您可以轻松获取事件信息，如果您想进一步处理它，您可以将 lambda 添加到 SNS 主题。