CloudWatch agent not sending metrics or logs: fix it in five checks

Memory and disk-space metrics aren't collected by EC2 by default. They need the CloudWatch agent. When a dashboard shows gaps, work through these checks.

#1. Is the agent running?

# Linux
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status
sudo tail -50 /opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log

# Windows
& "C:\Program Files\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1" -a status
Get-Content "C:\ProgramData\Amazon\AmazonCloudWatchAgent\Logs\amazon-cloudwatch-agent.log" -Tail 50

"status": "stopped" or "configstatus": "not configured" → go to step 2.

#2. Is the configuration loaded?

# Load the config from SSM Parameter Store (recommended) and start the agent
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config -m ec2 -s -c ssm:AmazonCloudWatch-linux-standard

A minimal Linux config for memory and disk:

{
  "metrics": {
    "namespace": "CWAgent",
    "append_dimensions": { "InstanceId": "${aws:InstanceId}" },
    "metrics_collected": {
      "mem":  { "measurement": ["mem_used_percent"] },
      "disk": { "measurement": ["used_percent"], "resources": ["/"] }
    }
  },
  "logs": {
    "logs_collected": { "files": { "collect_list": [
      { "file_path": "/var/log/messages", "log_group_name": "/ec2/linux/messages", "log_stream_name": "{instance_id}" }
    ] } }
  }
}

#3. Can it authenticate?

The instance role needs CloudWatchAgentServerPolicy, plus ssm:GetParameter if the config is stored in SSM. Log errors such as AccessDenied or NoCredentialProviders point here.

aws sts get-caller-identity                     # run on the instance: is a role attached?

#4. Can it reach the endpoints?

Private subnets without NAT need interface endpoints for monitoring (metrics) and logs (CloudWatch Logs), plus ssm if you fetch the config from there.

curl -s -o /dev/null -w "%{http_code}\n" https://monitoring.ap-south-1.amazonaws.com
curl -s -o /dev/null -w "%{http_code}\n" https://logs.ap-south-1.amazonaws.com

#5. Are you looking in the right place?

• Agent metrics are in the CWAgent namespace (or the one you configured), not AWS/EC2.
• Dimensions must match exactly. Adding ImageId or InstanceType creates a different metric series, and alarms on the old dimensions go silent.
• Log groups must exist, or the role needs logs:CreateLogGroup.

#Common log errors

Tip

Deploy and update the agent fleet-wide with SSM Distributor (AmazonCloudWatchAgent package) and State Manager, so new instances are covered automatically.