Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Monitoring Amazon DataSync with Amazon CloudWatch

You can monitor Amazon DataSync using Amazon CloudWatch, which collects and processes raw data from DataSync into readable, near real-time metrics. These statistics are retained for a period of 15 months.

By default, DataSync metrics data is automatically sent to CloudWatch in 5-minute intervals. For more information, see What is Amazon CloudWatch? in the Amazon CloudWatch User Guide.

CloudWatch metrics for DataSync

Amazon CloudWatch provides metrics that you can use to get information about DataSync performance and troubleshoot issues. You can see CloudWatch metrics for DataSync by use the following tools:

For information, see Using Amazon CloudWatch metrics in the Amazon CloudWatch User Guide.

DataSync metrics use the Amazon/DataSync namespace and provide metrics for the following dimensions:

The Amazon/DataSync namespace includes the following metrics.

Allowing DataSync to upload logs to CloudWatch log groups

DataSync requires sufficient permissions to send logs to your CloudWatch log group. When you create a task using the console, DataSync can automatically create an IAM resource policy with the correct permissions for you.

The following example is a resource policy that grants these permissions.

{
    "Statement": [
        {
            "Sid": "DataSyncLogsToCloudWatchLogs",
            "Effect": "Allow",
            "Action": [
                "logs:PutLogEvents",
                "logs:CreateLogStream"
            ],
            "Principal": {
                "Service": "datasync.amazonaws.com"
            },
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": [
                        "arn:aws-cn:datasync:region:account-id:task/*"
                    ]
                },
                "StringEquals": {
                    "aws:SourceAccount": "account-id"
                }
            },
            "Resource": "arn:aws-cn:logs:region:account-id:log-group:*:*"
        }
    ],
    "Version": "2012-10-17"
}

The policy uses condition statements to ensure that only DataSync tasks from the specified account have access to the specified CloudWatch log group. We recommend using the aws:SourceArn and aws:SourceAccount global condition context keys in these condition statements to protect against the confused deputy problem. For more information, see Cross-service confused deputy prevention.

To specify the DataSync task or tasks, replace region with the Region code for the Amazon Web Services Region where the tasks are located and replace account-id with the Amazon Web Services account ID of the account that contains the tasks. To specify the CloudWatch log group, replace the same values. You can also modify the Resource statement to target specific log groups. For more information about using SourceArn and SourceAccount, see Global condition keys in the IAM User Guide.

To apply the policy, save this policy statement to a file on your local computer. Then run the following Amazon CLI command to apply the resource policy:

aws logs put-resource-policy --policy-name trustDataSync --policy-document file://full-path-to-policy-file

For information, see Working with log groups and log streams in the Amazon CloudWatch Logs User Guide.

Configuring logging for your DataSync transfer task

You can publish details about your DataSync transfer task to an CloudWatch log group.

Before you begin

DataSync needs permission to upload logs to a CloudWatch log group. You can set this up through an IAM resource policy a couple different ways: