Skip to main content
Sumo Logic

Install the AWS Lambda ULM App and View the Dashboards

Instructions for installing the Sumo Logic App for AWS Lambda ULM, and descriptions of the app dashboards.

Install the Sumo Logic App

Now that you have set up collection for AWS Lambda ULM, install the Sumo Logic App for AWS Lambda ULM to use the preconfigured searches and Dashboards that provide insight into your data. 

To install the app:

Locate and install the app you need from the App Catalog. If you want to see a preview of the dashboards included with the app before installing, click Preview Dashboards.

  1. From the App Catalog, search for and select the app. 
  2. To install the app, click Add to Library and complete the following fields.
    1. App Name. You can retain the existing name, or enter a name of your choice for the app.

    2. CloudWatch Lambda Log Source. Select either of these options:
      • Choose Source Category, and select the Source Category from the list.
      • Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. Example: (_sourceCategory=MyCategory).
    3. CloudTrail Lambda Data Events Source. Select either of these options:
      • Choose Source Category, and select the Source Category from the list.
      • Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. Example: (_sourceCategory=MyCategory).
    4. CloudWatch Lambda Metrics Source. Select either of these options:
      • Choose Source Category, and select the Source Category from the list.
      • Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. Example: (_sourceCategory=MyCategory).
    5. Advanced. Select the Location in Library (the default is the Personal folder in the library), or click New Folder to add a new folder.
    6. Click Add to Library.

About measurements

This sections explains some of the measurements and calculations underlying the information presented in dashboard panels.

  • Duration (ms). Function duration is the elapsed wall clock time, in milliseconds, from when a function starts executing as a result of an invocation to when it stops executing. Function duration is a measure of performance
  • Billed Duration. Bill duration values are rounded up to the nearest 100 millisecond.
  • Memory Size. The amount of memory allocated for a function.
  • Max Memory (MB) Used. The amount of memory used by a function, in MBs. This is a measure of performance.
  • Compute Usage (GBs). The product of Memory Size and Billed Duration (Memory Size * Billed Duration).
  • Billed Compute  = memory configured on the function (in GB) x duration of the request (in seconds). In the actual query, Sumo Logic converts MB to GB and milliseconds to seconds to get the real billing numbers used. Actual cost varies by customer. This measurement is used to measure cost.
  • Unused Memory. This is Memory Size - Max Memory Used = Unused Memory. Because you are billed based on Memory Size (which you allocate), this is an indicator of not allocating appropriately.
  • IteratorAge. This AWS Lambda CloudWatch metric is emitted for stream-based invocations (functions triggered by an Amazon DynamoDB stream or Kinesis stream). Measures, in milliseconds, the age of the last record for each batch of records processed. Age is the difference between the time Lambda received the batch, and the time the last record in the batch was written to the stream.

Dashboards

AWS Lambda ULM - Overview

See an overview of AWS Lambda activity, including caller locations, memory usage, invoking services, top IAM users, errors, and top functions by memory used and duration.

AWSLambdaULMOverview.png

Log - Location of Callers. The count and location of callers in the last 24 hours on a world map.

Log - Allocated Memory vs Memory Used. Comparison between the allocated memory and used memory in a stacked bar chart for the last 24 hours.

AWS Services Invoking Functions. The count of AWS services invoking functions in the last 24 hours on a line chart.

Top IAM User Invoking Functions. The count of IAM users invoking functions in the last 24 hours on a line chart.

Errors Comparison - Today vs Yesterday vs Last Week. Comparison of errors (total errors of all Lambda functions) today, yesterday and last week.

Duration Comparison - Today vs Yesterday vs Last Week. Comparison of Duration (total of the invocation durations of all Lambda functions) today, yesterday and last week.

Throttling Comparison - Today vs Yesterday vs Last Week. Comparison of throttled invocations (total throttled invocations of all Lambda functions) today, yesterday and last week.

Invocation Comparison - Today vs Yesterday vs Last Week. Comparison of number of invocations (total invocations of all Lambda functions) today, yesterday and last week.

Log - Error Count. Total error count.

Log - Top Functions by MemoryUsed. The top 10 functions by MaxMemoryUsed in a table chart for the last 24 hours.

Log - Top Functions by Duration. The top 10 functions by Average Duration in a table chart for the last 24 hours.

AWS Lambda ULM - Error Analysis 

See an analysis of errors in AWS Lambda.AWSLambdaULMErrorAnalysis.png

Log - Error Count. Total error count.

Log - Error Breakdown by Function. Displays errors by function in a pie chart for the last 24 hours. 

Log - Top Error Messages. The top 10 error messages and count by function in a table for the last 24 hours.

Error by Functions - Trend. The number of errors in the executions of functions as a line on a chart juxtaposed with a dotted line for the average invocation errors for the last 24 hours.

Throttling by Functions - Trend. The number of throttled invocations of functions  as a line on a chart  juxtaposed with a dotted line for the average throttled invocations for the last 24 hours.

IteratorAge by Functions - Trend. The maximum IteratorAge for stream-based function invocations in milliseconds as a line on a chart  juxtaposed with a dotted line for the averageIteratorAge for the last 24 hours.

DeadLetterErrors by Functions - Trend. The number of dead letter errors in the executions of functions as a line on a chart  juxtaposed with a dotted line for the average dead letter errors for the last 24 hours.

Log - AWS Services Invoking Functions - Outlier. Shows outliers in the AWS services invoking functions in the last 24 hours on a column chart.

Log - Duration by Hour (Sum) - Outlier. Displays the duration and threshold of functions by the hour using the sum as an outlier chart. The duration is the line on the chart and the threshold is the area, displayed on a timeline for the last 24 hours.

Log - Duration by Hour (Average) - Outlier. Shows the duration and threshold of functions by the hour using the average as an outlier chart. The duration is the line on the outlier chart and the threshold is the area, displayed on a timeline for the last 24 hours.

Log - Max Memory (MB) Used by Hour - Outlier. Shows the maximum memory used by functions as a the line on an outlier chart, with the threshold displayed as the area, on a timeline for the last 24 hours.

AWS Lambda ULM - Performance Analysis I

See an analysis of performance in AWS Lambda, including memory usage, function duration, recent request details, and compute usage.

AWSLambdaULMPerformanceAnalysisI.png

Log - Allocated Memory vs Memory Used. A comparison between the allocated memory and used memory in a stacked bar chart for the last 24 hours.

Duration (ms) by Function - Timeline. Shows the duration by function in milliseconds in a stacked column chart on a timeline for the last 24 hours.

Recent Request Details. See the details of recent AWS Lambda Cloudwatch Logs including function, requestid, duration, billed duration, memory size, max memory used, over the last 15 minutes.

Duration (ms) by Function. Displays the duration in milliseconds by function in a pie chart for the last 24 hours.

Max Memory (MB) Used by Function. Shows the maximum memory used in MBs by function in a pie chart for the last 24 hours. 

MaxMemoryUsed by Function - Timeline. Displays the max memory used in MBs by function in a stacked column chart on a timeline for the last 24 hours.

Average Duration vs Average BilledDuration. A comparison of the average duration and average billed duration by function in a stacked bar chart for the last 24 hours.

Compute Usage (GB-s) by Function - Timeline. Displays the compute usage by function in GBs per second on a stacked column chart on a timeline for the last 24 hours.

Compute Usage (GB-s) by Function. Provides information on compute usage in GBs per second by function in a pie chart for the last 24 hours.

AWS Lambda ULM - Performance Analysis II

See an analysis of AWS Lambda performance, including concurrent executions, and advanced auto-regressive trend analyses of and unused memory, billed duration by hour, and compute usage. 

AWSLambdaULMPerformanceAnalysisII.png


Top 10 Function by Duration. The execution duration of functions in milliseconds as a line on a chart juxtaposed with a dotted line for the average duration for the last 24 hours.

Unused Memory - Trend. Displays information on functions’ unused memory for memory size, memory used, and unused memory as a line chart, and juxtaposed with a trendline showing the predicted unused memory on a timeline for the last 24 hours. This panel uses an advanced auto-regressive (AR) algorithm to learn patterns in the data. It automatically detects the cyclical patterns in the data and uses the cycles in its prediction.

Billed Duration by Hour - Trend. Provides information on the billed duration of functions by the hour as a line chart juxtaposed with a trendline for the predicted billed duration on a timeline for the last 24 hours.  This panel uses an advanced auto-regressive (AR) algorithm to learn patterns in the data. It automatically detects the cyclical patterns in the data and uses the cycles in its prediction. 

Memory Used (MB) - Trend.  Provides information on max memory in MBs used by functions as a line on a chart, with the predicted max memory as a trendline on a timeline for the last 24 hours.  This panel uses an advanced auto-regressive (AR) algorithm to learn patterns in the data. It automatically detects the cyclical patterns in the data and uses the cycles in its prediction.

Compute Usage (GB-s) - Trend. Provides information on compute usage by functions in GBs per second as a line on a chart, with the predicted compute usage as a trendline on a timeline for the last 24 hours.  This panel uses an advanced auto-regressive (AR) algorithm to learn patterns in the data. It automatically detects the cyclical patterns in the data and uses the cycles in its prediction.

UnreservedConcurrentExecutions Comparison - Today vs Yesterday vs Last Week. A comparison of the number of unreserved concurrent executions today, yesterday and last week.

ConcurrentExecutions by Functions. The number of concurrent executions for functions with a custom concurrency limit defined, as a line on a chart juxtaposed with a dotted line for the sum of concurrent executions by regions for the last 24 hours.

AWS Lambda ULM - Request Analysis 

See information about requests in AWS Lambda, including functions, caller locations and details, invocations,  and top functions, caller types, source IPs and callers.

AWSLambdaULMRequestAnalysis.png

Function by Version_Alias, RequestID. Details on the functions, version alias, and requestID in a table chart for the last 1 hour.

Location of Callers. The count and location of callers in the last 24 hours on a world map.

Function Callers Details. The details of function callers in the last 15 minutes including the function name, function version, caller, caller type, source IP, AWS region and count, displayed in a table.

Invoke Breakdown by Function Name. The count of the CloudTrail Lambda function invocation event by name in the last 24 hours on a pie chart.

Invoke Breakdown by Function Version. The count of the CloudTrail Lambda function invocation event by version in the last 24 hours on a line chart.

Metrics - Invocation By Function - Trend. The count and trend of function invocations in the last 24 hours on a line chart.

Top  Functions. The top 10 functions by request count in a table chart for the last 1 hour

Top Caller Types. The top 10 Caller Types by request count in a table chart for the last 1 hour

Top Source IPs. The top 10 Source IPs by request count in a table chart for the last 1 hour

Top Callers. The top 10 Callers by request count in a table chart for the last 1 hour

Log - Pass vs Fail Requests. A comparison of failed  and successful requests by function in a stacked column chart for the last 24 hours.

Requests by Function, Version_Alias Counts. Provides information on requests by function and version alias counts in stacked column chart for the last 1 hour.

Requests by Version_Alias. The number of requests by version alias in a pie chart for the last 24 hours.

Threat Table based on Caller IP Address. Threat details based on caller IP address in the last 24 hours including the source IP, malicious confidence, actor, function name, caller, user agent, label name, and count.

Invocation by Function Version  - Trend. The count of the CloudTrail Lambda function invocation event by version in the last 24 hours on a line chart.

AWS Lambda ULM - Usage Analysis

See information about AWS Lambda usage, including function usage by AWS services, user agents, and IAM users. 

AWSLambdaULMUsageAnalysis.png

Time Compare - AWS Services Invoking Functions. A comparison of the number of calls made by AWS Services today and yesterday.

AWS Services Invoking Functions - Trend. The count and trend of AWS Services invoking functions over time in the last 24 hours on a line chart.

Time Compare - User Agent. A comparison of the number of calls made by different user agents today and yesterday.

User Agent Breakdown. The count of function invoke events by user agent in the last 24 hours on a bar chart.

IAM User Invoking Functions Trend. The count and trend of IAM users invoking functions over time in the last 24 hours on a line chart.

Top IAM User Invoking Functions. The count of IAM users invoking functions in the last 24 hours on a line chart.

IAM User Invoking Functions - Outlier. Outliers in the IAM users invoking functions in the last 24 hours on a column chart.

Time Compare - IAM User Invoking Function. A comparison of the number of calls made by IAM users today and yesterday.