---
cuppy_hub: aws
cuppy_path: reference/cloudwatch/errors.md
cuppy_section: docs
cuppy_doc: 5XN6-S5CE
cuppy_doc_uuid: 12ce2abb-e2a6-421b-84b5-fbbf5dc00c93
cuppy_permalink: https://cuppy.io/aws/d/5XN6-S5CE
cuppy_version: 4
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/aws/docs/reference/cloudwatch/errors
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 63c98fdb3f857196b4728bd8fd791c06cdb1a2dd94e95534908e4bc5a7c3703c
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# CloudWatch Logs and CloudWatch metrics errors

**Most observability failures are silent:** the call succeeds, but the log, metric or event never shows up where you look. Check the silent-failure tables first, then the exceptions.

## Silent failures

| Symptom | Cause → fix | Check |
|---|---|---|
| A custom metric isn't in the console or `list-metrics` | A **new** metric takes up to 15 minutes to appear in `ListMetrics`. Back-dated data (more than 3 hours old) can take hours to become queryable. Check the namespace and Region | `aws cloudwatch list-metrics --namespace <ns> --metric-name <m>` after 15 minutes |
| The metric exists but the graph or alarm is empty (`INSUFFICIENT_DATA`) | The **dimensions** you query must match exactly what you published, unit included. Custom metrics aren't aggregated across dimensions | `list-metrics` output: compare each `Dimensions` entry with your query, exactly |
| EMF metrics never appear | Check the `AWS/Logs` namespace for extraction failures. Likely causes: the event isn't purely the JSON object; dimension keys or values aren't top-level; a value is out of range; an array has more than 100 items; more than 100 metric definitions; a timestamp outside 14 days past to 2 hours future (`reference/cloudwatch/metrics-and-math.md`) | `aws cloudwatch list-metrics --namespace AWS/Logs` for EMF error metrics; read a raw event in the log group |
| Some log events missing after `PutLogEvents` succeeded | Events more than **2 hours in the future** or **older than 14 days or the retention period** are rejected individually. Read `rejectedLogEventsInfo` in the response | The `PutLogEvents` response → `rejectedLogEventsInfo` (`tooNewLogEventStartIndex`, `tooOldLogEventEndIndex`, `expiredLogEventEndIndex`) |
| A log group has no logs from Lambda | The function never ran, or its role can't write logs (`guides/lambda/debug-failing-function.md`). Or it logs to a custom group set in `LoggingConfig` | `aws lambda get-function-configuration --function-name <fn> --query LoggingConfig` → `LogGroup`; the function's `Invocations` metric |
| `console.debug` lines missing from Lambda | JSON log format defaults the application log level to INFO (`reference/cloudwatch/log-groups.md`) | Same call → `LogFormat`, `ApplicationLogLevel` |
| Old logs "disappeared" | Retention expired them. Deletion runs up to 72 hours after expiry | `aws logs describe-log-groups --log-group-name-prefix <g>` → `retentionInDays` |
| Logs in a KMS-encrypted group can't be read | The key is disabled, the logs principal was removed from the key policy, or the key was deleted, which makes the data unrecoverable. A newly associated key takes up to 5 minutes to apply | `describe-log-groups` → `kmsKeyId`, then `aws kms describe-key --key-id <k> --query KeyMetadata.KeyState` |
| Alarm fired once and never notified again | Actions run on **state change** only (`guides/cloudwatch/create-alarms.md`) | `aws cloudwatch describe-alarm-history --alarm-name <a> --history-item-type StateUpdate` |

## CloudWatch Logs exceptions

| Exception | Cause → fix | Check |
|---|---|---|
| `ResourceNotFoundException` | The log group or stream doesn't exist in this account and Region. Create it, or check the name (`/aws/lambda/<fn>`) and Region | `aws logs describe-log-groups --log-group-name-prefix <g> --region <r>` |
| `ResourceAlreadyExistsException` | Creating a group or stream that exists. Treat it as success in setup code | Same call |
| `InvalidParameterException` | A malformed request. For `PutLogEvents`, commonly events **not in chronological order**, a batch spanning more than 24 hours, more than 10,000 events, or over 1,048,576 bytes (messages plus 26 bytes per event). For queries: a bad log group identifier, such as an ARN with a trailing `*` | The message names the field; sort events by timestamp and check the batch's time span |
| `InvalidSequenceTokenException`, `DataAlreadyAcceptedException` | **No longer returned**, because `PutLogEvents` ignores sequence tokens. Delete the retry logic for them | Search your code for `sequenceToken` |
| `MalformedQueryException` | Logs Insights syntax error. The `QueryCompileError` gives the location | The error's `QueryCompileError` → `location` |
| `LimitExceededException` | A maximum was reached, for example concurrent Logs Insights queries (shared with dashboards and scheduled queries). Back off | `aws logs describe-queries --status Running` |
| `ThrottlingException` | The per-account TPS quota for that API was exceeded (`PutLogEvents`, `Create*`, `Describe*`: adjustable in Service Quotas). The SDK retries it; batch more per call | Calls per second for that API (SDK retry logs, CloudTrail `errorCode`) |
| `ServiceQuotaExceededException` | A resource quota, such as the number of log groups. Request an increase | Service Quotas for CloudWatch Logs |
| `AccessDeniedException` | An IAM denial (`reference/iam/errors.md`). On `associate-kms-key` / `create-log-group --kms-key-id`, a missing `kms:DescribeKey` on the key | `aws sts get-caller-identity`; for KMS, `aws kms get-key-policy` for `logs.<region>.amazonaws.com` |
| `OperationAbortedException`, `ConflictException` | A concurrent change to the same resource. Retry | Another process changing the same group (CloudTrail) |
| `UnrecognizedClientException` | Invalid access key ID or secret key (`reference/sts/credential-sources.md`) | `aws sts get-caller-identity` with the same credentials |
| `ServiceUnavailableException` (500) | Transient. Retry with backoff | Retry succeeds; the AWS Health Dashboard |
| `SessionStreamingException`, `SessionTimeoutException` | Live Tail session errors. Restart the session | Restart `StartLiveTail` and see if it recurs |

## CloudWatch metrics and alarms exceptions

The `PutMetricData` causes are documented. The rest are the hub's reading of the SDK exception names.

| Exception (SDK name; API error code) | Cause → fix | Check |
|---|---|---|
| `InvalidParameterValueException` (`InvalidParameterValue`) | A value out of range or invalid: NaN or Infinity, beyond ±2^360, a timestamp more than 2 weeks old or 2 hours ahead, a bad namespace, or more than 30 dimensions | Print the values you send: NaN, Infinity, out-of-range or the timestamp |
| `InvalidParameterCombinationException` (`InvalidParameterCombination`) | Parameters that can't go together. On alarms, for example, both `MetricName` and `Metrics` math (UNVERIFIED example) | The request JSON: which mutually exclusive fields are both set |
| `MissingRequiredParameterException` (`MissingParameter`) | A required field is absent | The message names the field |
| `LimitExceededException` / `LimitExceededFault` | A quota such as the number of alarms. Request an increase or consolidate | Service Quotas for CloudWatch; `aws cloudwatch describe-alarms --query 'length(MetricAlarms)'` |
| `ResourceNotFoundException`, `DashboardNotFoundError` | Wrong alarm, dashboard or other resource name, or the wrong Region | `aws cloudwatch describe-alarms --alarm-names <a> --region <r>` or `list-dashboards` |
| `DashboardInvalidInputError`, `InvalidFormatFault` | Dashboard body or input JSON is invalid | The error's `dashboardValidationMessages` |
| `KmsAccessDeniedException`, `KmsKeyDisabledException`, `KmsKeyNotFoundException` | A KMS key used by a CloudWatch feature can't be used (`reference/kms/key-policies-and-errors.md`) | `aws kms describe-key` and `get-key-policy` for the key the feature uses |
| `ConcurrentModificationException` | A parallel update. Retry | Another deploy updating the same resource (CloudTrail) |
| `InternalServiceFault` (`InternalServiceError`, 500) | Transient. Retry | Retry succeeds |

## When none of these fits

Check where the data should be, step by step: did the producer call succeed (CloudTrail `PutLogEvents` / `PutMetricData` / `PutEvents` with `errorCode`, `guides/cloudtrail/find-who-did-what.md`)? Is it the right account, Region, log group, namespace and dimensions? Is it within retention, and past the visibility delays above? Collect the request ID from the SDK error for AWS Support.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->