Guides

How to Install the CloudWatch Agent on EC2 for Memory, Disk Metrics and Logs

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

EC2 does not send memory or disk space metrics by default, because they are inside the operating system. To get them, attach an IAM role with CloudWatchAgentServerPolicy to the instance, install the CloudWatch agent (sudo dnf install -y amazon-cloudwatch-agent on Amazon Linux 2023), run the config wizard, and start it with amazon-cloudwatch-agent-ctl. After a few minutes, mem_used_percent and disk_used_percent appear under CWAgent, and you can set alarms.

sudo dnf install -y amazon-cloudwatch-agent
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/bin/config.json
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status

A live example first

Our WordPress server on a t3.small crashed twice from low memory, and CloudWatch showed nothing unusual, because only CPU was visible. Let us add memory, disk and the nginx error log.

1. IAM: create a role for EC2 with the managed policy CloudWatchAgentServerPolicy, then EC2 → instance → Actions → Security → Modify IAM role → attach it.
2. Install:

sudo dnf install -y amazon-cloudwatch-agent

3. Instead of the wizard, write a small config by hand at /opt/aws/amazon-cloudwatch-agent/etc/config.json:

{
  "metrics": {
    "append_dimensions": { "InstanceId": "${aws:InstanceId}" },
    "metrics_collected": {
      "mem":  { "measurement": ["mem_used_percent"] },
      "disk": { "measurement": ["used_percent"], "resources": ["/"] }
    }
  },
  "logs": {
    "logs_collected": { "files": { "collect_list": [
      { "file_path": "/var/log/nginx/error.log",
        "log_group_name": "/rb/wordpress/nginx-error", "retention_in_days": 14 }
    ] } }
  }
}

4. Start:

sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status

{ "status": "running", "starttime": "2026-10-16T19:20:11+00:00", "version": "1.300..." }

5. After about 5 minutes, CloudWatch → Metrics → CWAgent → InstanceId shows mem_used_percent and disk_used_percent. We create an alarm at 85% memory for 5 minutes that emails us through SNS.

The next time memory climbed, we got the email before the crash. Friends, you cannot fix what you cannot see.

How does the agent work?

The basic EC2 metrics are collected by the hypervisor from outside the virtual machine. It can see CPU and network, but not how the OS uses its memory or how full each filesystem is. The agent runs inside the OS, reads those numbers (and log files), and sends them to CloudWatch using the instance role's temporary credentials.

How do I set it up step by step?

1. Create and attach an IAM role with CloudWatchAgentServerPolicy.
2. Install the agent for your OS (below).
3. Create a config with the wizard or by hand.
4. Start the agent with fetch-config.
5. Check -a status and the agent log if needed.
6. Wait 5 minutes and find the metrics under CWAgent.
7. Create alarms and set log retention so costs stay low.

Install on each OS

Which logs to send, by stack

Send error logs first. Full access logs can be large, so think about cost.

Common errors

The same idea on other clouds

• Azure: Azure Monitor Agent with data collection rules.
• Google Cloud: the Ops Agent.
• Open source: Prometheus node_exporter + Grafana, which many teams also run on AWS.

Real example

Many outage write-ups start with "the disk filled up" or "the server ran out of memory", and both are invisible in default EC2 metrics. For example, Elasticsearch clusters stop accepting writes when disk use reaches the flood-stage watermark (95% by default), and teams without disk metrics often learn about it from angry users. A simple disk_used_percent > 80% alarm from the CloudWatch agent turns that surprise into a routine ticket.

Mistakes to avoid

1. Collecting every metric every 10 seconds. Custom metrics cost money; start with memory and root disk at 60 seconds.
2. No log retention. Set retention_in_days, or logs are kept forever.
3. Putting access keys in the config. Use the instance role.

Summary table