Data Exploration
Use Data Exploration in Security Audit to query and analyze resource logs for identity authentication, host, and VPC resources.
Prerequisites
You have registered the required resources in the Resource Center.
Try in Playground
Alibaba Cloud Playground provides a demo environment where you can experience the main features of Cloud Monitor 2.0.
-
Go to the Playground Demo environment or the . You will land in a workspace by default.
-
In the navigation bar, click Log Audit. Alternatively, under All Features, click Log Audit.
-
In the Log Audit navigation pane, click , Host, or VPC to use the related exploration features.
Identity Authentication
View Logs
In the left-side navigation pane of the Log Audit console, choose Data Exploration > Identity to open the ActionTrail log query page. The Logstore name is displayed at the top of the page, for example actiontrail_security-actiontrail-xxx. You can enter a query statement in the search box. A time-series bar chart in the middle of the page shows the log distribution trend. The Raw Logs tab below the chart lists the details of each log entry, including the following key fields:
-
acsRegion: the region where the event occurred -
eventName: the name of the API operation -
eventRW: the read/write type -
eventSource: the service that generated the event -
eventTime: the time when the event occurred -
eventType: the event type -
requestId: the request ID
In the Displayed Fields pane on the left side, you can select indexed fields and other fields to filter the log entries that are displayed.
Host
View Logs
You can query host system logs and host runtime logs separately.
VPC
View Logs
In the left-side navigation pane, choose Data Exploration > VPC to open the VPC Flow Logs page. The log topic of this page is vpc_log. A search box is provided at the top of the page, and a bar chart below it shows the number of log entries and their time distribution. Click the Raw Logs tab to view the details of each log entry. The field pane on the left side lists the following indexed fields:
-
account-id -
action -
bytes -
direction -
dstaddr -
dstport -
end -
eni-id -
log-status -
packets -
protocol -
srcaddr -
srcport -
start -
tcp-flag -
traffic -
version -
vm-id
Container Runtime
View Logs
You can query container runtime logs.