操作审计支持查询云服务器ECS(Elastic Compute Service)相关事件。当ECS操作出现异常时,您可以快速查询事件并获取事件发生的时间、地域、ECS实例等信息。本文为您举例说明ECS相关事件。

阿里云账号通过控制台停止ECS实例

以下示例表示,在北京时间2021年08月04日14:11:36,阿里云账号调用StopInstance接口停止了北京地域ID为i-2zeip56clb391fpf****的ECS实例。

{
  "eventId": "239EB588-CD24-522E-B0B5-174A1A588BE0",
  "eventVersion": 1,
  "eventSource": "ecs-cn-hangzhou-share.aliyuncs.com",
  "requestParameters": {
    "charset": "UTF-8",
    "AcsHost": "ecs-cn-hangzhou-share.aliyuncs.com",
    "AcsProduct": "Ecs",
    "RequestId": "239EB588-CD24-522E-B0B5-174A1A588BE0",
    "InstanceId": "i-2zeip56clb391fpf****",
    "ForceStop": false,
    "AcceptLanguage": "zh-CN"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "Apache-HttpClient/4.5.7 (Java/1.8.0_275)",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::ECS::Instance": [
      "i-2zeip56clb391fpf****"
    ]
  },
  "userIdentity": {
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-04T06:11:36Z"
      }
    },
    "accountId": "154735325685****",
    "principalId": "154735325685****",
    "type": "root-account",
    "userName": "root"
  },
  "serviceName": "Ecs",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-26",
  "requestId": "239EB588-CD24-522E-B0B5-174A1A588BE0",
  "eventTime": "2021-08-04T06:11:36Z",
  "isGlobal": false,
  "acsRegion": "cn-beijing",
  "eventName": "StopInstance"
}

示例中关键字段含义如下:

  • userIdentity.type:请求者的身份类型。取值为root-account,表示阿里云账号。

  • serviceName:事件相关的阿里云服务名称。取值为Ecs,表示ECS。

  • eventName:事件名称。取值为StopInstance,表示停止实例。

  • referencedResources:事件影响的资源列表。取值为{"ACS::ECS::Instance": ["i-2zeip56clb391fpf****"]},表示ECS实例i-2zeip56clb391fpf****

  • acsRegion:事件发生的地域。取值为cn-beijing,表示北京地域。

  • eventTime:事件发生的时间(UTC格式)。取值为2021-08-04T06:11:36Z,表示北京时间2021年08月04日14:11:36。

RAM用户通过控制台停止ECS实例

以下示例表示,在北京时间2021年08月04日13:29:30,RAM用户ecs_operator3调用StopInstance接口停止了北京地域ID为i-2zegxcy8f0htnq1o****的ECS实例。

{
  "eventId": "5E197C8B-081F-5A0C-A86A-4B6F266CA80B",
  "eventVersion": 1,
  "eventSource": "ecs-cn-hangzhou.aliyuncs.com",
  "requestParameters": {
    "AcsHost": "ecs-cn-hangzhou.aliyuncs.com",
    "AcsProduct": "Ecs",
    "RequestId": "5E197C8B-081F-5A0C-A86A-4B6F266CA80B",
    "InstanceId": "i-2zegxcy8f0htnq1o****",
    "ForceStop": "True",
    "https": "False"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "ros.console.aliyun.com",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::ECS::Instance": [
      "i-2zegxcy8f0htnq1o****"
    ]
  },
  "userIdentity": {
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-04T05:29:30Z"
      }
    },
    "accountId": "182872313731****",
    "principalId": "20499042382297****",
    "type": "ram-user",
    "userName": "ecs_operator3"
  },
  "serviceName": "Ecs",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-26",
  "requestId": "5E197C8B-081F-5A0C-A86A-4B6F266CA80B",
  "eventTime": "2021-08-04T05:29:30Z",
  "isGlobal": false,
  "acsRegion": "cn-beijing",
  "eventName": "StopInstance"
}

示例中关键字段含义如下:

  • userIdentity.type:请求者的身份类型。取值为ram-user,表示RAM用户。

  • userIdentity.userName:请求者的RAM用户名称。

  • serviceName:事件相关的阿里云服务名称。取值为Ecs,表示ECS。

  • eventName:事件名称。取值为StopInstance,表示停止实例。

  • referencedResources:事件影响的资源列表。取值为{"ACS::ECS::Instance": ["i-2zegxcy8f0htnq1o****"]},表示ECS实例i-2zegxcy8f0htnq1o****

  • acsRegion:事件发生的地域。取值为cn-beijing,表示北京地域。

  • eventTime:事件发生的时间(UTC格式)。取值为2021-08-04T05:29:30Z,表示北京时间2021年08月04日13:29:30。

RAM用户通过AK调用API停止ECS实例

以下示例表示,在北京时间2021年08月04日11:42:20,RAM用户通过AK LTAIIzSdydLc****调用StopInstance接口停止了杭州地域ID为i-bp1buct0j6jywbfp****的ECS实例。

{
  "eventId": "A9171DC9-638E-5561-BA2E-69B1B956C8F4",
  "eventVersion": 1,
  "eventSource": "ecs.aliyuncs.com",
  "requestParameters": {
    "AcsHost": "ecs.aliyuncs.com",
    "AcsProduct": "Ecs",
    "RequestId": "A9171DC9-638E-5561-BA2E-69B1B956C8F4",
    "InstanceId": "i-bp1buct0j6jywbfp****",
    "ForceStop": true
  },
  "sourceIpAddress": "192.168.XX.XX",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::ECS::Instance": [
      "i-bp1buct0j6jywbfp****"
    ]
  },
  "userIdentity": {
    "accessKeyId": "LTAIIzSdydLc****",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-04T03:42:20Z"
      }
    },
    "accountId": "122196828764****",
    "principalId": "23079124770506****",
    "type": "ram-user",
    "userName": "hz-perf-cluster"
  },
  "serviceName": "Ecs",
  "additionalEventData": {
    "Scheme": "https",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-26",
  "requestId": "A9171DC9-638E-5561-BA2E-69B1B956C8F4",
  "eventTime": "2021-08-04T03:42:20Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "StopInstance"
}

示例中关键字段含义如下:

  • userIdentity.accessKeyId:发起API调用的AccessKey ID。取值为LTAIIzSdydLc****

  • userIdentity.principalId:AK所属的账号ID。取值为23079124770506****

  • serviceName:事件相关的阿里云服务名称。取值为Ecs,表示ECS。

  • eventName:事件名称。取值为StopInstance,表示停止实例。

  • referencedResources:事件影响的资源列表。取值为{"ACS::ECS::Instance": ["i-bp1buct0j6jywbfp****"]},表示ECS实例i-bp1buct0j6jywbfp****

  • acsRegion:事件发生的地域。取值为cn-hangzhou,表示杭州地域。

  • eventTime:事件发生的时间(UTC格式)。取值为2021-08-04T03:42:20Z,表示北京时间2021年08月04日11:42:20。

RAM角色通过角色扮演停止ECS实例

以下示例表示,在北京时间2021年08月04日14:50:10,阿里云服务弹性伸缩通过扮演服务关联角色aliyunserviceroleforautoscaling,停止了北京地域ID为i-2zeeryqubk6402qw****的ECS实例。

{
  "eventId": "E7233050-120B-5684-93E4-49A6754D8252",
  "eventVersion": 1,
  "eventSource": "ecs-cn-hangzhou-inner.aliyuncs.com",
  "requestParameters": {
    "securityToken": "CAISlQJ1q6Ft5B2yfSjIr5beG4322+YZ0baYaVWElTksTe4VtfD8szz2IH9NenVoA+wetPg+mmtT6/welr5+UIQAXkHfdsp36NFa+hiWb4fPstGx8eThLDMywS/BZSTg1er+Ps/bLrqECNrPBnnAkihsu8iYERypQ12iN7CQlJdjda55dwKkbD1Adrw0T0kY3618D3bKMuu3ORPHm3fZCFES2jBxkmRi86+ysKb+g1j89AShmrJJ9tqoc8P7NpU2Z8xFPo3rjLAsRM3oyzVN7hVGzqBygZFf9C3P1tPnWAYIvUneabaMqIE+clQiO/JmAdlNqPntiPtjt/bNlo/60RFJMO9SSS3CWIe7y8LAGeWmJgLCqWAjiPSnGoABEJShxrqPitmfV2/wirLqZhYsiElHL0LIma0PRByFDMqa3Jo5O1xeeGvbhnLnHiqdTYUjap8X/fiew+pgNlLmjPwZ7AjWKFZVuO3yedhEpUE7aE14PJ2asbOw2b5T1CVH9FHYNWaCUliWBTIjAqI3UYkRktOiecZ2ZExp8g3+****=",
    "stsTokenPrincipalName": "aliyunserviceroleforautoscaling/ess-session-ecs_default",
    "AcsHost": "ecs-cn-hangzhou-inner.aliyuncs.com",
    "ServiceCode": "ecs",
    "AcsProduct": "Ecs",
    "RequestId": "E7233050-120B-5684-93E4-49A6754D8252",
    "InstanceId": "i-2zeeryqubk6402qw****",
    "RegionId": "cn-beijing",
    "stsTokenPlayerUid": 158643649596****
  },
  "sourceIpAddress": "Internal",
  "userAgent": "AlibabaCloud (Linux; amd64) Java/1.8.0_102-b52 Core/4.5.3 HTTPClient/InternalHttpClient",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::ECS::Instance": [
      "i-2zeeryqubk6402qw****"
    ]
  },
  "userIdentity": {
    "accessKeyId": "STS.NUkP7B698ftsks5q9yAa9****",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-04T06:50:10Z"
      }
    },
    "accountId": "138549619371****",
    "principalId": "37164024024963****:ess-session-ecs_default",
    "type": "assumed-role",
    "userName": "aliyunserviceroleforautoscaling:ess-session-ecs_default"
  },
  "serviceName": "Ecs",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-26",
  "requestId": "E7233050-120B-5684-93E4-49A6754D8252",
  "eventTime": "2021-08-04T06:50:10Z",
  "isGlobal": false,
  "acsRegion": "cn-beijing",
  "eventName": "StopInstance"
}

示例中关键字段含义如下:

  • userIdentity.type:请求者的身份类型。取值为assumed-role,表示RAM角色。

  • userIdentity.userName:请求者的用户名。格式为{roleName}:{sessionName}roleName表示被扮演的角色名称,sessionName表示进行角色扮演时指定的名称。取值为aliyunserviceroleforautoscaling:ess-session-ecs_default,表示被扮演的RAM角色名称是aliyunserviceroleforautoscaling,进行角色扮演时指定的名称为ess-session-ecs_default

    说明

    aliyunserviceroleforautoscaling是弹性伸缩服务的服务关联角色,用于授权弹性伸缩服务访问关联云资源。

  • requestParameters.stsTokenPlayerUid:扮演者的阿里云账号ID。取值为158643649596****

  • referencedResources:事件影响的资源列表。取值为{"ACS::ECS::Instance": ["i-2zeeryqubk6402qw****"]},表示ECS实例i-2zeeryqubk6402qw****

  • serviceName:事件相关的阿里云服务名称。取值为Ecs,表示ECS。

  • eventName:事件名称。取值为StopInstance,表示停止实例。

  • acsRegion:事件发生的地域。取值为cn-beijing,表示北京地域。

  • eventTime:事件发生的时间(UTC格式)。取值为2021-08-04T06:50:10Z,表示北京时间2021年08月04日14:50:10。