Working with insights in DevOps Guru

Use this section to get a high-level overview of the insight. You can see the status of the insight (Ongoing or Closed), how many AWS CloudFormation stacks are affected, when the insight started, ended, and was last updated, and the related operations item if there is one.

If an insight is grouped at the stack level, then you can choose the number of affected stacks to see their names. The anomalous behavior that created the insight occurred in resources created by the affected stacks. If an insight is grouped at the account level, then the number is zero or does not appear.

For more information, see Understanding how anomalous behaviors are grouped into insights.

The name of an insight depends on whether it is grouped at the stack level or the account level.

For more information, see Understanding how anomalous behaviors are grouped into insights.

Choose the Aggregated metrics tab to view metrics that are related to the insight. In the table, each row represents one metric. You can see which AWS CloudFormation stack created the resource that emitted the metric, the name of the resource, and its type. Not all metrics are associated with an AWS CloudFormation stack or have a name.

When there are multiple resources anomalous at the same time, the timeline view aggregates the resources and presents their anomalous metrics in a single timeline for easy analysis. The red lines on a timeline indicate spans of time when a metric emitted unusual values. To zoom in, use your mouse to choose a specific time range. You can also use the magnifying glass icons to zoom in and out.

Choose a red line in the timeline to view detailed information. In the window that opens, you can:

Choose the Graphed anomalies tab to view detailed graphs for each of the insight's anomalies. One tile appears for each anomaly with details about unusual behavior detected in related metrics. You can investigate and look at an anomaly at the resource level and per statistic. The graphs are grouped by metric name. In each tile, you can choose a specific time range in the timeline to zoom. You can also use the magnifying glass icons to zoom in and out, or choose a predefined duration in hours, days, or weeks (1H, 3H, 12H, 1D, 3D, 1W, or 2W).

Choose View all statistics and dimensions to see details about the anomaly. In the window that opens, you can:

When you enable log anomaly detection, DevOps Guru tags your CloudWatch log groups so you can view log groups related to your insights. In the Log groups section on the insight details page, each row in the table represents one log group and lists the related resource.

When there are multiple anomalous log groups at the same time, the timeline view aggregates them and presents them in a single timeline for easy analysis. The purple lines on a timeline indicate spans of time when a log group experienced log anomalies.

Choose a purple line in the timeline to view a sample of log anomaly information such as keyword exceptions and numerical deviations. Choose View log group details to view log anomalies. In the window that opens, you can:

In Related events, view AWS CloudTrail events that are related to your insight. Use these events to help understand, diagnose, and address the underlying cause of the anomalous behavior.

In Recommendations, you can view suggestions that might help you resolve the underlying problem. When DevOps Guru detects anomalous behavior, it attempts to create recommendations. An insight might contain one, multiple, or zero recommendations.

All resources contained in the stacks you choose are analyzed, and all detected insights are grouped at the stack level.

All resources in your account and Region are analyzed, and there are three possible grouping scenarios for detected insights.