True Story: The Interview Question That Changed How I Troubleshoot EC2 — AWS CloudWatch or Ping?
The Interview Question That Stuck With Me
When I was starting my career in cloud, I had a job interview that left a lasting impression. The interviewer asked me a seemingly simple question:
“What is the first thing you would do if your EC2 instance was unresponsive?”
Without hesitation, I answered, “I’d ping it to check for reachability.”
The interviewer smiled and said, “Your first response should be checking CloudWatch logs.”
At the time, I was taken aback — was I wrong? Should CloudWatch really be my first stop when troubleshooting an unresponsive EC2 instance? That question pushed me to dig deeper into how AWS monitors EC2 instances and whether CloudWatch logs ping failures.
Does CloudWatch Log Ping Failures?
The short answer: No, AWS CloudWatch does not log ping (ICMP) failures by default. However, that doesn’t mean you can’t monitor EC2 availability effectively. Here’s what actually happens:
- CloudWatch collects EC2 instance status metrics (but not ICMP responses).
- If the EC2 instance is unreachable, status check failures are logged.
- CloudWatch Logs will only capture data if something is explicitly sending logs to it.
- ICMP (ping) failures are not automatically recorded.
So, while CloudWatch can help diagnose an issue, it won’t show a log entry just because your ping fails — you need additional monitoring.
Start with a Ping Test for a New Instance
If you’re dealing with a newly launched EC2 instance, CloudWatch might not yet be configured. In such cases, pinging the instance is a quick way to check basic reachability.
Get Effie Njoki’s stories in your inbox
Join Medium for free to get updates from this writer.
If the ping fails, the next logical step is to check security groups (SGs) and network ACLs (NACLs) to ensure they allow inbound ICMP traffic. If those configurations look fine, then proceed to deeper troubleshooting.
Use CloudWatch Metrics for EC2 Status Checks
AWS provides built-in CloudWatch metrics that can indicate if an instance is unhealthy:
- StatusCheckFailed_Instance: Indicates OS-level failure (e.g., software crash, full disk, CPU overload).
- StatusCheckFailed_System: Indicates infrastructure-level failure (e.g., lost connectivity, hardware failure).
Solution: Set up a CloudWatch alarm on these metrics to get notified when an instance is unreachable.
You can Log Ping Failures with a Custom Lambda Function
Since AWS doesn’t log ping failures automatically, you can create a Lambda function (or a small script running on another instance) that:
- Pings your EC2 instance.
- Logs failures to CloudWatch Logs.
- Sends alerts via SNS (Simple Notification Service).
Who Was Right, the Interviewer or Me?
Looking back, we were both partially right:
- Ping is a quick, first-level check, especially when dealing with a potential networking issue.
- CloudWatch Logs won’t help unless logging is explicitly configured but CloudWatch metrics and alarms are crucial for automated monitoring.
- For a new instance, before CloudWatch is set up, pinging helps verify basic connectivity.
The real takeaway? A layered approach is best. Never just rely on ping.
AWS provides powerful tools to monitor EC2 instances, but they don’t log ping failures by default. By setting up a layered approach you can ensure your instances are always monitored effectively.
Layered Set up:
- CloudWatch Alarms, AWS provides built-in CloudWatch metrics that can indicate if an instance is unhealthy and notify when an instance is unreachable:
StatusCheckFailed_Instance: Indicates OS-level failure e.g software crash, full disk, CPU overload.
StatusCheckFailed_System: Indicates infrastructure-level failure e.g lost connectivity, hardware failure.
- Route 53 Health Checks to monitor EC2 reachability via TCP, HTTP, or HTTPS. If health check fails you can Trigger a CloudWatch alarm, Automate responses with AWS Lambda, Route traffic elsewhere using DNS failover
- Lambda logging that will ping your ec2 instance, log failures to CloudWatch Logs and trigger alerts via SNS, &
- VPC Flow Logs to help determine if network traffic is being blocked by: Security groups, Network ACLs and Route table misconfigurations. Enable VPC Flow Logs and send them to CloudWatch Logs for deeper insights
So next time an EC2 instance goes silent, don’t just rely on ping — let AWS do the heavy lifting!
