# Monitoring Amazon Keyspaces (for Apache Cassandra)
<a name="monitoring-overview"></a>

Monitoring is an important part of maintaining the reliability, availability, and performance of Amazon Keyspaces and your other AWS solutions. AWS provides the following monitoring tools to watch Amazon Keyspaces, report when something is wrong, and take automatic actions when appropriate:
+ *Amazon Keyspaces* offers a preconfigured dashboard in the AWS Management Console showing the latency and errors aggregated across all tables in the account. 
+ *Amazon CloudWatch* monitors your AWS resources and the applications you run on AWS in real time. You can collect and track metrics with customized dashboards. For example, you can create a baseline for normal Amazon Keyspaces performance in your environment by measuring performance at various times and under different load conditions. As you monitor Amazon Keyspaces, store historical monitoring data so that you can compare it with current performance data, identify normal performance patterns and performance anomalies, and devise methods to address issues. To establish a baseline, you should, at a minimum, monitor for system errors. For more information, see the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/).
+ *Amazon CloudWatch alarms* monitor a single metric over a time period that you specify, and perform one or more actions based on the value of the metric relative to a given threshold over a number of time periods. For example if you use Amazon Keyspaces in provisioned mode with application auto scaling, the action is a notification sent by the Amazon Simple Notification Service (Amazon SNS) to evaluate an Application Auto Scaling policy. 

  CloudWatch alarms do not invoke actions simply because they are in a particular state. The state must have changed and been maintained for a specified number of periods. For more information, see [Monitoring Amazon Keyspaces with Amazon CloudWatch](monitoring-cloudwatch.md).
+ *Amazon CloudWatch Logs* enables you to monitor, store, and access your log files from Amazon Keyspaces tables, CloudTrail, and other sources. CloudWatch Logs can monitor information in the log files and notify you when certain thresholds are met. You can also archive your log data in highly durable storage. For more information, see the [Amazon CloudWatch Logs User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/).
+ *AWS CloudTrail* captures API calls and related events made by or on behalf of your AWS account and delivers the log files to an Amazon S3 bucket that you specify. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred. For more information, see the [AWS CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/).

*Amazon EventBridge* is a serverless event bus service that makes it easy to connect your applications with data from a variety of sources. EventBridge delivers a stream of real-time data from your own applications, Software-as-a-Service (SaaS) applications, and AWS services and routes that data to targets such as Lambda. This enables you to monitor events that happen in services, and build event-driven architectures. For more information, see the [Amazon EventBridge User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/).

**Topics**
+ [Monitoring Amazon Keyspaces with Amazon CloudWatch](monitoring-cloudwatch.md)
+ [Logging Amazon Keyspaces API calls with AWS CloudTrail](logging-using-cloudtrail.md)

# Monitoring Amazon Keyspaces with Amazon CloudWatch
<a name="monitoring-cloudwatch"></a>

You can monitor Amazon Keyspaces using Amazon CloudWatch, which collects raw data and processes it into readable, near real-time metrics. These statistics are kept for 15 months, so that you can access historical information and gain a better perspective on how your web application or service is performing. 

You can also set alarms that watch for certain thresholds, and send notifications or take actions when those thresholds are met. For more information, see the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/).

**Note**  
To get started quickly with a preconfigured CloudWatch dashboard showing common metrics for Amazon Keyspaces, you can use an CloudFormation template available from [https://github.com/aws-samples/amazon-keyspaces-cloudwatch-cloudformation-templates](https://github.com/aws-samples/amazon-keyspaces-cloudwatch-cloudformation-templates).

**Topics**
+ [How do I use Amazon Keyspaces metrics?](#how-to-use-metrics)
+ [Amazon Keyspaces metrics and dimensions](metrics-dimensions.md)
+ [Viewing Amazon Keyspaces metrics in CloudWatch](view-metrics.md)
+ [Creating CloudWatch alarms to monitor Amazon Keyspaces](creating-alarms.md)

## How do I use Amazon Keyspaces metrics?
<a name="how-to-use-metrics"></a>

The metrics reported by Amazon Keyspaces provide information that you can analyze in different ways. The following list shows some common uses for the metrics. These are suggestions to get you started, not a comprehensive list. For more information about metrics and retention, see [Metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html#Metric). 


****  

|  How can I?  |  Relevant metrics  | 
| --- | --- | 
|  How can I determine if any system errors occurred?  |  You can monitor `SystemErrors` to determine whether any requests resulted in a server error code. Typically, this metric should be equal to zero. If it isn't, you might want to investigate.  | 
|  How can I compare average provisioned read to consumed read capacity?  |  To monitor average provisioned read capacity and consumed read capacity [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/monitoring-cloudwatch.html) You can now compare your average consumed read capacity to your provisioned capacity. For more information on basic arithmetic functions and how to create a time series see [Using metric math](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/using-metric-math.html).  | 
|  How can I compare average provisioned write to consumed write capacity?  |  To monitor average provisioned write capacity and consumed write capacity [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/monitoring-cloudwatch.html) You can now compare your average consumed write capacity to your provisioned capacity. For more information on basic arithmetic functions and how to create a time series see [Using metric math](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/using-metric-math.html).   | 

# Amazon Keyspaces metrics and dimensions
<a name="metrics-dimensions"></a>

When you interact with Amazon Keyspaces, it sends metrics and dimensions to Amazon CloudWatch. All metrics are aggregated and reported every minute. The following sections are an overview of all available metrics for Amazon Keyspaces.

**Topics**
+ [Amazon Keyspaces metrics](#keyspaces-metrics-dimensions)
+ [Dimensions for Amazon Keyspaces metrics](#keyspaces-metric-dimensions)
+ [Metrics for Amazon Keyspaces change data capture (CDC)](#keyspaces-cdc-metrics)
+ [Dimensions for Amazon Keyspaces change data capture (CDC) metrics](#keyspaces-metric-dimensions-cdc)

## Amazon Keyspaces metrics
<a name="keyspaces-metrics-dimensions"></a>

Amazon CloudWatch aggregates Amazon Keyspaces metrics at one-minute intervals.

Not all statistics, such as `Average` or `Sum`, are applicable for every metric. However, all of these values are available through the Amazon Keyspaces console, or by using the CloudWatch console, AWS CLI, or AWS SDKs for all metrics. In the following table, each metric has a list of valid statistics that are applicable to that metric.


| Metric | Description | 
| --- | --- | 
| AccountMaxTableLevelReads |  The maximum number of read capacity units that can be used by a table of an account. For on-demand tables this limit caps the maximum read request units a table can use. Units: `Count` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| AccountMaxTableLevelWrites |  The maximum number of write capacity units that can be used by a table of an account. For on-demand tables this limit caps the maximum write request units a table can use. Units: `Count` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| AccountProvisionedReadCapacityUtilization |  The percentage of provisioned read capacity units utilized by an account. Units: `Percent` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| AccountProvisionedWriteCapacityUtilization |  The percentage of provisioned write capacity units utilized by an account. Units: `Percent` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| BillableTableSizeInBytes |  The billable size of the table in bytes. It is the sum of the encoded size of all rows in the table. This metric helps you track your table storage costs over time. Units: `Bytes` Dimensions: `Keyspace, TableName` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ConditionalCheckFailedRequests |  The number of failed lightweight transaction (LWT) write requests. The `INSERT`, `UPDATE`, and `DELETE` operations let you provide a logical condition that must evaluate to true before the operation can proceed. If this condition evaluates to false, `ConditionalCheckFailedRequests` is incremented by one. Condition checks that evaluate to false consume write capacity units based on the size of the row. For more information, see [Estimate capacity consumption of lightweight transactions in Amazon Keyspaces](lightweight_transactions.md). Units: `Count` Dimensions: `Keyspace, TableName` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ConsumedReadCapacityUnits |  The number of read capacity units consumed over the specified time period. For more information, see [Read/Write capacity mode](https://docs.aws.amazon.com/keyspaces/latest/devguide/ReadWriteCapacityMode.html).  To understand your average throughput utilization per second, use the `Sum` statistic to calculate the consumed throughput for the one minute period. Then divide the sum by the number of seconds in a minute (60) to calculate the average `ConsumedReadCapacityUnits` per second (recognizing that this average does not highlight any large but brief spikes in read activity that occurred during that minute). For more information on comparing average consumed read capacity to provisioned read capacity, see [How do I use Amazon Keyspaces metrics?](monitoring-cloudwatch.md#how-to-use-metrics)  Units: `Count` Dimensions: `Keyspace, TableName` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ConsumedWriteCapacityUnits |  The number of write capacity units consumed over the specified time period. You can retrieve the total consumed write capacity for a table. For more information, see [Read/Write capacity mode](https://docs.aws.amazon.com/keyspaces/latest/devguide/ReadWriteCapacityMode.html).  To understand your average throughput utilization per second, use the `Sum` statistic to calculate the consumed throughput for the one minute period. Then divide the sum by the number of seconds in a minute (60) to calculate the average `ConsumedWriteCapacityUnits` per second (recognizing that this average does not highlight any large but brief spikes in write activity that occurred during that minute). For more information on comparing average consumed write capacity to provisioned write capacity, see [How do I use Amazon Keyspaces metrics?](monitoring-cloudwatch.md#how-to-use-metrics)  Units: `Count` Dimensions: `Keyspace, TableName` Valid Statistics:  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| MaxProvisionedTableReadCapacityUtilization |  The percentage of provisioned read capacity units utilized by the highest provisioned read table of an account. Units: `Percent` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| MaxProvisionedTableWriteCapacityUtilization |  The percentage of provisioned write capacity utilized by the highest provisioned write table of an account. Units: `Percent` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| PerConnectionRequestRateExceeded |  Requests to Amazon Keyspaces that exceed the per-connection request rate quota. Each client connection to Amazon Keyspaces can support up to 3000 CQL requests per second. Clients can create multiple connections to increase throughput. When you're using multi-Region replication, each replicated write also contributes to this quota. As a best practice, we recommend to increase the number of connections to your tables to avoid `PerConnectionRequestRateExceeded` errors. There is no limit to the number of connections you can have in Amazon Keyspaces. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ProvisionedReadCapacityUnits |  The number of provisioned read capacity units for a table. The `TableName` dimension returns the `ProvisionedReadCapacityUnits` for the table. Units: `Count` Dimensions: `Keyspace, TableName` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ProvisionedWriteCapacityUnits |  The number of provisioned write capacity units for a table. The `TableName` dimension returns the `ProvisionedWriteCapacityUnits` for the table. Units: `Count` Dimensions: `Keyspace, TableName` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ReadThrottleEvents |  Requests to Amazon Keyspaces that exceed the provisioned read capacity for a table, or account level quotas, request per connection quotas, or partition level quotas. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ReplicationLatency |  This metric only applies to multi-Region keyspaces and measures the time it took to replicate `updates`, `inserts`, or `deletes` from one replica table to another replica table in a multi-Region keyspace. Units: `Millisecond` Dimensions: `TableName, ReceivingRegion` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| ReturnedItemCountBySelect |  The number of rows returned by multi-row `SELECT` queries during the specified time period. Multi-row `SELECT` queries are queries which do not contain the fully qualified primary key, such as full table scans and range queries. The number of rows *returned* is not necessarily the same as the number of rows that were evaluated. For example, suppose that you requested a `SELECT *` with `ALLOW FILTERING` on a table that had 100 rows, but specified a `WHERE` clause that narrowed the results so that only 15 rows were returned. In this case, the response from `SELECT` would contain a `ScanCount` of 100 and a `Count` of 15 returned rows. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| StoragePartitionThroughputCapacityExceeded |  Requests to an Amazon Keyspaces storage partition that exceed the throughput capacity of the partition. Amazon Keyspaces storage partitions can support up to 1000 WCU/WRU per second and 3000 RCU/RRU per second. We recommend reviewing your data model to distribute read/write traffic across more partitions to mitigate these exceptions.   Logical Amazon Keyspaces partitions can span multiple storage partitions and are virtually unbounded in size.  Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| SuccessfulRequestCount |  The number of successful requests processed over the specified time period.  Units: `Count`  Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| SuccessfulRequestLatency |  The successful requests to Amazon Keyspaces during the specified time period. `SuccessfulRequestLatency` can provide two different kinds of information: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html) `SuccessfulRequestLatency` reflects activity only within Amazon Keyspaces and doesn’t take network latency or client-side activity into account.  Units: `Milliseconds`  Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| SystemErrors |  The requests to Amazon Keyspaces that generate a `ServerError` during the specified time period. A `ServerError` usually indicates an internal service error. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| SystemReconciliationDeletes |  The units consumed to delete tombstoned data when client-side timestamps are enabled. Each `SystemReconciliationDelete` provides enough capacity to delete or update up to 1KB of data per row. For example, to update a row that stores 2.5 KB of data and to delete one or more columns within the row at the same time requires 3 `SystemReconciliationDeletes`. Or, to delete an entire row that contains 3.5 KB of data requires 4 `SystemReconciliationDeletes`.  Units: `Count` Dimensions: `Keyspace, TableName` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| TTLDeletes |  The units consumed to delete or update data in a row by using Time to Live (TTL). Each `TTLDelete` provides enough capacity to delete or update up to 1KB of data per row. For example, to update a row that stores 2.5 KB of data and to delete one or more columns within the row at the same time requires 3 TTL deletes. Or, to delete an entire row that contains 3.5 KB of data requires 4 TTL deletes.  Units: `Count` Dimensions: `Keyspace, TableName` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| UserErrors |  Requests to Amazon Keyspaces that generate an `InvalidRequest` error during the specified time period.  `InvalidRequest` errors usually represent a client-side error, for example an invalid combination of parameters, an attempt to update a non-existent table, or an incorrect request signature. `UserErrors` represent the aggregate of invalid requests for the current AWS Region and the current AWS account. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| WriteThrottleEvents |  Requests to Amazon Keyspaces that exceed the provisioned write capacity for a table, or account level quotas, request per connection quotas, or partition level quotas.  Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 

## Dimensions for Amazon Keyspaces metrics
<a name="keyspaces-metric-dimensions"></a>

The metrics for Amazon Keyspaces are qualified by the values for the account, table name, or operation. You can use the CloudWatch console to retrieve Amazon Keyspaces data along any of the dimensions in the following table.


|  Dimension  |  Description  | 
| --- | --- | 
|  Keyspace  |  This dimension limits the data to a specific keyspace. This value can be any keyspace in the current Region and the current AWS account.   | 
|  Operation  |  This dimension limits the data to one of the Amazon Keyspaces CQL operations, such as `INSERT` or `SELECT` operations.   | 
|  TableName  |  This dimension limits the data to a specific table. This value can be any table name in the current Region and the current AWS account. If the table name is not unique within the account, you must also specify `Keyspace`.  | 

## Metrics for Amazon Keyspaces change data capture (CDC)
<a name="keyspaces-cdc-metrics"></a>

The following metrics are available in your CloudWatch account that monitor API calls to the Amazon Keyspaces change data capture (CDC) endpoint.


| Metric | Description | 
| --- | --- | 
| ReturnedRecordsCount |  The number of stream records returned by `GetRecords` operations during the specified time period. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| SuccessfulRequestLatency |  The successful requests to Amazon Keyspaces during the specified time period. `SuccessfulRequestLatency` can provide two different kinds of information: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html) `SuccessfulRequestLatency` reflects activity only within Amazon Keyspaces CDC APIs and doesn’t take network latency or client-side activity into account.  Units: `Milliseconds`  Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| SystemErrors |  The requests to Amazon Keyspaces CDC that generate a `HTTP 500` status code during the specified time period. A `HTTP 500` status code usually indicates an internal service error. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 
| UserErrors |  Requests to Amazon Keyspaces CDC that generate an `HTTP 400` status code during the specified time period.  `UserErrors` represents the aggregate of `HTTP 400` errors for Amazon Keyspaces CDC in the current AWS Region and the current AWS account. Units: `Count` Dimensions: `Keyspace, TableName, Operation` Valid Statistics: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/metrics-dimensions.html)  | 

## Dimensions for Amazon Keyspaces change data capture (CDC) metrics
<a name="keyspaces-metric-dimensions-cdc"></a>

The metrics for Amazon Keyspaces are qualified by the values for the account, table name, or operation. You can use the CloudWatch console to retrieve Amazon Keyspaces data along any of the dimensions in the following table.


|  Dimension  |  Description  | 
| --- | --- | 
|  StreamLabel  |  This dimension limits the data to a specific change data capture (CDC) stream when `KeyspaceName` and `TableName` are specified.   | 
|  Keyspace  |  This dimension limits the data to a specific keyspace. This value can be any keyspace in the current Region and the current AWS account.   | 
|  TableName  |  This dimension limits the data to a specific table. This value can be any table name in the current Region and the current AWS account. If the table name is not unique within the account, you must also specify `Keyspace`.  | 
|  Operation  |  This dimension limits the data to one of the following Amazon Keyspaces Streams API operations: `GetRecords`, `GetStream` `GetShardIterator`, and `ListStreams`.   | 

# Viewing Amazon Keyspaces metrics in CloudWatch
<a name="view-metrics"></a>

When you interact with Amazon Keyspaces, it sends the following metrics and dimensions to Amazon CloudWatch. All metrics are aggregated and reported every minute. You can use the following procedures to view the metrics for Amazon Keyspaces.

**To view metrics using the CloudWatch console**

Metrics are grouped first by the service namespace, and then by the various dimension combinations within each namespace.

1. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/).

1. If necessary, change the AWS Region. On the navigation bar, choose the Region where your AWS resources reside. For more information, see [AWS service endpoints](http://docs.aws.amazon.com/general/latest/gr/rande.html).

1. In the navigation pane, choose **Metrics**.

1. Under the **All metrics** tab, choose `AWS/Cassandra.`

**To view metrics using the AWS CLI**
+ At a command prompt, use the following command.

  ```
  1. aws cloudwatch list-metrics --namespace "AWS/Cassandra"                        
  ```

# Creating CloudWatch alarms to monitor Amazon Keyspaces
<a name="creating-alarms"></a>

You can create an Amazon CloudWatch alarm for Amazon Keyspaces that sends an Amazon Simple Notification Service (Amazon SNS) message when the alarm changes state. An alarm watches a single metric over a time period that you specify. It performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon SNS topic or an Application Auto Scaling policy. 

When you use Amazon Keyspaces in provisioned mode with Application Auto Scaling, the service creates two pairs of CloudWatch alarms on your behalf. Each pair represents your upper and lower boundaries for provisioned and consumed throughput settings. These CloudWatch alarms are triggered when the table's actual utilization deviates from your target utilization for a sustained period of time. To learn more about CloudWatch alarms created by Application Auto Scaling, see [How Amazon Keyspaces automatic scaling works](autoscaling.md#autoscaling.HowItWorks).

Alarms invoke actions for sustained state changes only. CloudWatch alarms do not invoke actions simply because they are in a particular state. The state must have changed and been maintained for a specified number of periods.

For more information about creating CloudWatch alarms, see [Using Amazon CloudWatch alarms](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html) in the *Amazon CloudWatch User Guide*.

# Logging Amazon Keyspaces API calls with AWS CloudTrail
<a name="logging-using-cloudtrail"></a>

Amazon Keyspaces is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Amazon Keyspaces. CloudTrail captures Data Definition Language (DDL) API calls and Data Manipulation Language (DML) API calls for Amazon Keyspaces as events. The calls that are captured include calls from the Amazon Keyspaces console and programmatic calls to the Amazon Keyspaces API operations. 

If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon Simple Storage Service (Amazon S3) bucket, including events for Amazon Keyspaces. 

If you don't configure a trail, you can still view the most recent supported events on the CloudTrail console in **Event history**. Using the information collected by CloudTrail, you can determine the request that was made to Amazon Keyspaces, the IP address from which the request was made, who made the request, when it was made, and additional details. 

To learn more about CloudTrail, see the [AWS CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/).

**Topics**
+ [Configuring Amazon Keyspaces log file entries in CloudTrail](#configuring-ct-entries)
+ [Amazon Keyspaces Data Definition Language (DDL) information in CloudTrail](#keyspaces-in-cloudtrail-ddl)
+ [Amazon Keyspaces Data Manipulation Language (DML) information in CloudTrail](#keyspaces-in-cloudtrail-dml)
+ [Understanding Amazon Keyspaces log file entries](#understanding-ct-entries)

## Configuring Amazon Keyspaces log file entries in CloudTrail
<a name="configuring-ct-entries"></a>

Each Amazon Keyspaces API action logged in CloudTrail includes request parameters that are expressed in CQL query language. For more information, see the [CQL language reference for Amazon Keyspaces (for Apache Cassandra)](cql.md).

You can view, search, and download recent events in your AWS account. For more information, see [Viewing events with CloudTrail event history](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html). 

For an ongoing record of events in your AWS account, including events for Amazon Keyspaces, create a trail. A *trail* enables CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you create a trail in the console, the trail applies to all AWS Regions. The trail logs events from all Regions in the AWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs.

For more information, see the following topics in the *AWS CloudTrail User Guide*: 
+ [Overview for creating a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
+ [CloudTrail supported services and integrations](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html#cloudtrail-aws-service-specific-topics-integrations)
+ [Configuring Amazon SNS notifications for CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/configure-sns-notifications-for-cloudtrail.html)
+ [Receiving CloudTrail log files from multiple Regions](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html)
+ [Receiving CloudTrail log files from multiple accounts](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html)

Every event or log entry contains information about who generated the request. The identity information helps you determine the following: 
+ Whether the request was made with root or AWS Identity and Access Management (IAM) user credentials.
+ Whether the request was made with temporary security credentials for a role or federated user.
+ Whether the request was made by another AWS service.

For more information, see the [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html).

## Amazon Keyspaces Data Definition Language (DDL) information in CloudTrail
<a name="keyspaces-in-cloudtrail-ddl"></a>

CloudTrail is enabled on your AWS account when you create the account. When a DDL activity occurs in Amazon Keyspaces, that activity is automatically recorded as a CloudTrail event along with other AWS service events in **Event history**. The following table shows the DDL statements that are logged for Amazon Keyspaces. 


| CloudTrail `eventName` | Statement | CQL action | AWS SDK action | 
| --- | --- | --- | --- | 
|  CreateKeyspace  |  DDL  |  `CREATE KEYSPACE`  |  `CreateKeyspace`  | 
|  AlterKeyspace  |  DDL  |  `ALTER KEYSPACE`  |  `UpdateKeyspace`  | 
|  DropKeyspace  |  DDL  |  `DROP KEYSPACE`  |  `DeleteKeyspace`  | 
|  CreateTable  |  DDL  |  `CREATE TABLE`  |  `CreateTable`  | 
|  DropTable  |  DDL  |  `DROP TABLE`  |  `DeleteTable`  | 
|  AlterTable  |  DDL  |  `ALTER TABLE`  |  `UpdateTable`, `TagResource`, `UntagResource`  | 
| CreateUdt | DDL | `CREATE TYPE` | `CreateType` | 
| DropUdt | DDL | `DROP TYPE` | `DeleteType` | 
| GetStream | DDL | no CQL action available | `GetStream` | 
| ListStreams | DDL | no CQL action available | `ListStreams` | 

## Amazon Keyspaces Data Manipulation Language (DML) information in CloudTrail
<a name="keyspaces-in-cloudtrail-dml"></a>

To enable logging of Amazon Keyspaces DML statements with CloudTrail, you have to first enable logging of data plane API activity in CloudTrail. You can start logging Amazon Keyspaces DML events in new or existing trails by choosing to log activity for the **data event type** **Cassandra table** using the CloudTrail console, or by setting the `resources.type` value to `AWS::Cassandra::Table` using the AWS CLI, or CloudTrail API operations. For more information, see [Logging data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html). 

For more information and an example that shows how to create alarms for data events, see the following post on the AWS Database blog [Using DML auditing for Amazon Keyspaces (for Apache Cassandra)](https://aws.amazon.com/blogs/database/using-dml-auditing-for-amazon-keyspaces-for-apache-cassandra/).

The following table shows the data events that are logged by CloudTrail for `Cassandra table`.


| CloudTrail `eventName` | Statement | CQL action | AWS SDK actions | 
| --- | --- | --- | --- | 
|  Select  |  DML  |  `SELECT`  |  `GetKeyspace`, `GetTable`, `GetType`, `ListKeyspaces`, `ListTables`, `ListTypes`, `ListTagsForResource`  | 
|  Insert  |  DML  |  `INSERT`  |  no AWS SDK actions available  | 
|  Update  |  DML  |  `UPDATE`  |  no AWS SDK actions available  | 
|  Delete  |  DML  |  `DELETE`  |  no AWS SDK actions available  | 
|  `GetShardIterator`  |  DML  |  no CQL action available  |  `GetShardIterator`  | 
|  `GetRecords`  |  DML  |  no CQL action available  |  `GetRecords`  | 

## Understanding Amazon Keyspaces log file entries
<a name="understanding-ct-entries"></a>

CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order. 

The following example shows a CloudTrail log entry that demonstrates the `CreateKeyspace`, `DropKeyspace`, `CreateTable`, and `DropTable` actions: 

```
{
  "Records": [
    {
      "eventVersion": "1.05",
      "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AKIAIOSFODNN7EXAMPLE:alice",
        "arn": "arn:aws:sts::111122223333:assumed-role/users/alice",
        "accountId": "111122223333",
        "sessionContext": {
          "sessionIssuer": {
            "type": "Role",
            "principalId": "AKIAIOSFODNN7EXAMPLE",
            "arn": "arn:aws:iam::111122223333:role/Admin",
            "accountId": "111122223333",
            "userName": "Admin"
          },
          "webIdFederationData": {},
          "attributes": {
            "mfaAuthenticated": "false",
            "creationDate": "2020-01-15T18:47:56Z"
          }
        }
      },
      "eventTime": "2020-01-15T18:53:04Z",
      "eventSource": "cassandra.amazonaws.com",
      "eventName": "CreateKeyspace",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "10.24.34.01",
      "userAgent": "Cassandra Client/ProtocolV4",
      "requestParameters": {
        "rawQuery": "\n\tCREATE KEYSPACE \"mykeyspace\"\n\tWITH\n\t\tREPLICATION = {'class': 'SingleRegionStrategy'}\n\t\t",
        "keyspaceName": "mykeyspace"
      },
      "responseElements": null,
      "requestID": "bfa3e75d-bf4d-4fc0-be5e-89d15850eb41",
      "eventID": "d25beae8-f611-4229-877a-921557a07bb9",
      "readOnly": false,
      "resources": [
        {
          "accountId": "111122223333",
          "type": "AWS::Cassandra::Keyspace",
          "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/"
        }
      ],
      "eventType": "AwsApiCall",
      "apiVersion": "3.4.4",
      "recipientAccountId": "111122223333",
      "managementEvent": true,
      "eventCategory": "Management",
      "tlsDetails": {
          "tlsVersion": "TLSv1.2",
          "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
          "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    },
    {
      "eventVersion": "1.05",
      "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AKIAIOSFODNN7EXAMPLE:alice",
        "arn": "arn:aws:sts::111122223333:assumed-role/users/alice",
        "accountId": "111122223333",
        "sessionContext": {
          "sessionIssuer": {
            "type": "Role",
            "principalId": "AKIAIOSFODNN7EXAMPLE",
            "arn": "arn:aws:iam::111122223333:role/Admin",
            "accountId": "111122223333",
            "userName": "Admin"
          },
          "webIdFederationData": {},
          "attributes": {
            "mfaAuthenticated": "false",
            "creationDate": "2020-01-15T18:47:56Z"
          }
        }
      },
      "eventTime": "2020-01-15T19:28:39Z",
      "eventSource": "cassandra.amazonaws.com",
      "eventName": "DropKeyspace",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "10.24.34.01",
      "userAgent": "Cassandra Client/ProtocolV4",
      "requestParameters": {
        "rawQuery": "DROP KEYSPACE \"mykeyspace\"",
        "keyspaceName": "mykeyspace"
      },
      "responseElements": null,
      "requestID": "66f3d86a-56ae-4c29-b46f-abcd489ed86b",
      "eventID": "e5aebeac-e1dd-41e3-a515-84fe6aaabd7b",
      "readOnly": false,
      "resources": [
        {
          "accountId": "111122223333",
          "type": "AWS::Cassandra::Keyspace",
          "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/"
        }
      ],
      "eventType": "AwsApiCall",
      "apiVersion": "3.4.4",
      "recipientAccountId": "111122223333",
      "managementEvent": true,
      "eventCategory": "Management",
      "tlsDetails": {
          "tlsVersion": "TLSv1.2",
          "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
          "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    },
    {
      "eventVersion": "1.05",
      "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AKIAIOSFODNN7EXAMPLE:alice",
        "arn": "arn:aws:sts::111122223333:assumed-role/users/alice",
        "accountId": "111122223333",
        "sessionContext": {
          "sessionIssuer": {
            "type": "Role",
            "principalId": "AKIAIOSFODNN7EXAMPLE",
            "arn": "arn:aws:iam::111122223333:role/Admin",
            "accountId": "111122223333",
            "userName": "Admin"
          },
          "webIdFederationData": {},
          "attributes": {
            "mfaAuthenticated": "false",
            "creationDate": "2020-01-15T18:47:56Z"
          }
        }
      },
      "eventTime": "2020-01-15T18:55:24Z",
      "eventSource": "cassandra.amazonaws.com",
      "eventName": "CreateTable",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "10.24.34.01",
      "userAgent": "Cassandra Client/ProtocolV4",
      "requestParameters": {
        "rawQuery": "\n\tCREATE TABLE \"mykeyspace\".\"mytable\"(\n\t\t\"ID\" int,\n\t\t\"username\" text,\n\t\t\"email\" text,\n\t\t\"post_type\" text,\n\t\tPRIMARY KEY((\"ID\", \"username\", \"email\")))",
        "keyspaceName": "mykeyspace",
        "tableName": "mytable"
      },
      "responseElements": null,
      "requestID": "5f845963-70ea-4988-8a7a-2e66d061aacb",
      "eventID": "fe0dbd2b-7b34-4675-a30c-740f9d8d73f9",
      "readOnly": false,
      "resources": [
        {
          "accountId": "111122223333",
          "type": "AWS::Cassandra::Table",
          "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/mytable"
        }
      ],
      "eventType": "AwsApiCall",
      "apiVersion": "3.4.4",
      "recipientAccountId": "111122223333",
      "managementEvent": true,
      "eventCategory": "Management",
      "tlsDetails": {
          "tlsVersion": "TLSv1.2",
          "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
          "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    },
    {
      "eventVersion": "1.05",
      "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AKIAIOSFODNN7EXAMPLE:alice",
        "arn": "arn:aws:sts::111122223333:assumed-role/users/alice",
        "accountId": "111122223333",
        "sessionContext": {
          "sessionIssuer": {
            "type": "Role",
            "principalId": "AKIAIOSFODNN7EXAMPLE",
            "arn": "arn:aws:iam::111122223333:role/Admin",
            "accountId": "111122223333",
            "userName": "Admin"
          },
          "webIdFederationData": {},
          "attributes": {
            "mfaAuthenticated": "false",
            "creationDate": "2020-01-15T18:47:56Z"
          }
        }
      },
      "eventTime": "2020-01-15T19:27:59Z",
      "eventSource": "cassandra.amazonaws.com",
      "eventName": "DropTable",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "10.24.34.01",
      "userAgent": "Cassandra Client/ProtocolV4",
      "requestParameters": {
        "rawQuery": "DROP TABLE \"mykeyspace\".\"mytable\"",
        "keyspaceName": "mykeyspace",
        "tableName": "mytable"
      },
      "responseElements": null,
      "requestID": "025501b0-3582-437e-9d18-8939e9ef262f",
      "eventID": "1a5cbedc-4e38-4889-8475-3eab98de0ffd",
      "readOnly": false,
      "resources": [
        {
          "accountId": "111122223333",
          "type": "AWS::Cassandra::Table",
          "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/mytable"
        }
      ],
      "eventType": "AwsApiCall",
      "apiVersion": "3.4.4",
      "recipientAccountId": "111122223333",
      "managementEvent": true,
      "eventCategory": "Management",
      "tlsDetails": {
          "tlsVersion": "TLSv1.2",
          "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
          "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    }
  ]
}
```

The following log file shows an example of a `SELECT` statement.

```
{
    "eventVersion": "1.09",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AKIAIOSFODNN7EXAMPLE",
        "arn": "arn:aws:iam::111122223333:user/alice",
        "accountId": "111122223333",
        "userName": "alice"
    },
    "eventTime": "2023-11-17T10:38:04Z",
    "eventSource": "cassandra.amazonaws.com",
    "eventName": "Select",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "10.24.34.01",
    "userAgent": "Cassandra Client/ProtocolV4",
    "requestParameters": {
          "keyspaceName": "my_keyspace",
          "tableName": "my_table",
          "conditions": [
              "pk = **(Redacted)",
              "ck < 3**(Redacted)0",
              "region = 't**(Redacted)t'"
          ],
          "select": [
              "pk",
              "ck",
              "region"
          ],
          "allowFiltering": true
    },
    "responseElements": null,
    "requestID": "6d83bbf0-a3d0-4d49-b1d9-e31779a28628",
    "eventID": "e00552d3-34e9-4092-931a-912c4e08ba17",
    "readOnly": true,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::Cassandra::Table",
            "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/my_keyspace/table/my_table"
        }
    ],
    "eventType": "AwsApiCall",
    "apiVersion": "3.4.4",
    "managementEvent": false,
    "recipientAccountId": "111122223333",
    "eventCategory": "Data",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    }
}
```

The following log file shows an example of an `INSERT` statement.

```
{
    "eventVersion": "1.09",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AKIAIOSFODNN7EXAMPLE",
        "arn": "arn:aws:iam::111122223333:user/alice",
        "accountId": "111122223333",
        "userName": "alice"
    },
    "eventTime": "2023-12-01T22:11:43Z",
    "eventSource": "cassandra.amazonaws.com",
    "eventName": "Insert",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "10.24.34.01",
    "userAgent": "Cassandra Client/ProtocolV4",
    "requestParameters": {
          "keyspaceName": "my_keyspace",
          "tableName": "my_table",
          "primaryKeys": {
              "pk": "**(Redacted)",
              "ck": "1**(Redacted)8"
          },
          "columnNames": [
              "pk",
              "ck",
              "region"
          ],
          "updateParameters": {
              "TTL": "2**(Redacted)0"
          }
      }
    },
    "responseElements": null,
    "requestID": "edf8af47-2f87-4432-864d-a960ac35e471",
    "eventID": "81b56a1c-9bdd-4c92-bb8e-92776b5a3bf1",
    "readOnly": false,
    "resources": [
        {
          "accountId": "111122223333",
          "type": "AWS::Cassandra::Table",
          "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/my_keyspace/table/my_table"
        }
    ],
    "eventType": "AwsApiCall",
    "apiVersion": "3.4.4",
    "managementEvent": false,
    "recipientAccountId": "111122223333",
    "eventCategory": "Data",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    }
}
```

The following log file shows an example of an `UPDATE` statement.

```
{
    "eventVersion": "1.09",
    "userIdentity": {
          "type": "IAMUser",
          "principalId": "AKIAIOSFODNN7EXAMPLE",
          "arn": "arn:aws:iam::111122223333:user/alice",
          "accountId": "111122223333",
          "userName": "alice"
    },
    "eventTime": "2023-12-01T22:11:43Z",
    "eventSource": "cassandra.amazonaws.com",
    "eventName": "Update",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "10.24.34.01",
    "userAgent": "Cassandra Client/ProtocolV4",
    "requestParameters": {
          "keyspaceName": "my_keyspace",
          "tableName": "my_table",
          "primaryKeys": {
              "pk": "'t**(Redacted)t'",
              "ck": "'s**(Redacted)g'"
          },
          "assignmentColumnNames": [
             "nonkey"
          ],
          "conditions": [
              "nonkey < 1**(Redacted)7"
          ]
    },
    "responseElements": null,
    "requestID": "edf8af47-2f87-4432-864d-a960ac35e471",
    "eventID": "81b56a1c-9bdd-4c92-bb8e-92776b5a3bf1",
    "readOnly": false,
    "resources": [
        {
          "accountId": "111122223333",
          "type": "AWS::Cassandra::Table",
          "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/my_keyspace/table/my_table"
        }
    ],
    "eventType": "AwsApiCall",
    "apiVersion": "3.4.4",
    "managementEvent": false,
    "recipientAccountId": "111122223333",
    "eventCategory": "Data",
    "tlsDetails": {
          "tlsVersion": "TLSv1.3",
          "cipherSuite": "TLS_AES_128_GCM_SHA256",
          "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    }
}
```

The following log file shows an example of a `DELETE` statement.

```
{
    "eventVersion": "1.09",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AKIAIOSFODNN7EXAMPLE",
        "arn": "arn:aws:iam::111122223333:user/alice",
        "accountId": "111122223333",
        "userName": "alice",
    },
    "eventTime": "2023-10-23T13:59:05Z",
    "eventSource": "cassandra.amazonaws.com",
    "eventName": "Delete",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "10.24.34.01",
    "userAgent": "Cassandra Client/ProtocolV4",
    "requestParameters": {
        "keyspaceName": "my_keyspace",
        "tableName": "my_table",
        "primaryKeys": {
            "pk": "**(Redacted)",
            "ck": "**(Redacted)"
        },
        "conditions": [],
        "deleteColumnNames": [
            "m",
            "s"
        ],
        "updateParameters": {}
    },
    "responseElements": null,
    "requestID": "3d45e63b-c0c8-48e2-bc64-31afc5b4f49d",
    "eventID": "499da055-c642-4762-8775-d91757f06512",
    "readOnly": false,
    "resources": [
      {
        "accountId": "111122223333",
        "type": "AWS::Cassandra::Table",
        "ARN": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/my_keyspace/table/my_table"
      }
    ],
    "eventType": "AwsApiCall",
    "apiVersion": "3.4.4",
    "managementEvent": false,
    "recipientAccountId": "111122223333",
    "eventCategory": "Data",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "cassandra.us-east-1.amazonaws.com"
    }
}
```