Recieve alert on any specific windows service entered into stopped state - amazon-web-services

Question

I want email notification if any specific EC2 windows service entered into the stopped state.
I configured CloudWatch, able to receive logs of all windows services.
Created a lambda function to get notify when any service entered into the stopped state, but the problem is I am receiving alert only when I click on the test function.
I am receiving CloudWatch logs like this:
03:43:02 [System] [INFORMATION] [7036] [Service Control Manager] [mydomain.com] [The Background Intelligent Transfer Service service entered the running state.]
03:43:02 [System] [INFORMATION] [7040] [Service Control Manager] [mydomain.com] [The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.]
03:43:02 [System] [INFORMATION] [7036] [Service Control Manager] [mydomain.com] [The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.]
03:45:02 [System] [INFORMATION] [7040] [Service Control Manager] [mydomain.com] [The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.]
This is my lambda function:
import boto3
import time
client = boto3.client('logs')
sns = boto3.client('sns')
instance_name = "Development"
a1 = int(round(time.time() * 1000))
def lambda_handler(event, context):
response = client.get_log_events(
logGroupName = 'Eadev',
logStreamName = 'i-01fe1z56y790cq',
startTime = a1,
startFromHead = False
)
event01 = '[System] [INFORMATION] [7036] [Service Control Manager] [mydomain.com] [The DebtManager-Host service entered the stopped state.]'
event02 = '[System] [INFORMATION] [7036] [Service Control Manager] [mydomain.com] [The DebtManager-Controller service entered the stopped state.]'
for i in response['events']:
if event01 == i['message']:
print(event01)
sns.publish( TargetArn = "arn:aws:sns:us-east-1:3913948:testsns",Message = instance_name +" "+ event01)
if event02 == i['message']:
print(event02)
sns.publish( TargetArn = "arn:aws:sns:us-east-1:3913948:testsns",Message = instance_name +" "+ event02)
I expected email notification from any service stopped, but I am receiving alert only when I clicked on test in Lambda function.

Answer 1

It appears that your desired situation is:
The Amazon CloudWatch agent on the Windows instance sends log data to Amazon CloudWatch Logs
Send a notification when a particular entry is detected in the log file
Rather than triggering a Lambda function for every log message, you can use CloudWatch Logs Filter Metrics to trigger a CloudWatch Alarm:
Collecting Metrics and Logs from Amazon EC2 Instances and On-Premises Servers with the CloudWatch Agent
Searching and Filtering Log Data to detect the desired messages by Creating Metric Filters
This pushes metrics into Amazon CloudWatch Metrics
You can then create a traditional Amazon CloudWatch Alarm on the metric and have it trigger when a certain number of such messages are received
A CloudWatch Alarm can send a notification an Amazon SNS topic
For an end-to-end example, see: Use Amazon CloudWatch Logs Metric Filters to Send Alerts - The IT Hollow
Alternatively, you can use an AWS Lambda function:
Collect Metrics and Logs from Amazon EC2 Instances and On-Premises Servers with the CloudWatch Agent
Use Real-time Processing of Log Data with Subscriptions
It can accept a subscription filter to identify the records of interest
It can then trigger an AWS Lambda function, which you can program to do whatever you wish (eg send a message to an Amazon SNS topic)