Resource operation logs-Compute Nest(Compute Nest)-阿里云帮助中心

Compute Nest provides resource operation logs, providing an operation audit trail. These logs capture detailed information about actions on resources within an instance, such as starting or stopping an Elastic Compute Service (ECS) instance. You can use these logs for behavior analysis, security analysis, resource change tracking, and operation audits.

Understand resource logs

Log content

A resource operation log from Compute Nest contains the following information:

Operation name: The name of the action on a resource, such as stopping an instance in standard shutdown mode or executing a script.
Operation type: How the operation was triggered. For example, API Call indicates an operation triggered by an API call, while AliyunServiceEvent indicates one triggered by a script or a CloudOps Orchestration Service (OOS) template.
Associated resource IDs: The ID or IDs of the resources in the Compute Nest service instance associated with this log entry.
Username: The name of the user who performed the operation. This can be a RAM user acting manually or a RAM role assumed by a script.
Time: The timestamp when the operation occurred.
Impact level
Access key: The credential used for authentication. An access key is required for operations performed outside the console.
IP address

Details

In Details, you can view the raw log information.

The Details link is in the Actions column of the event list on the Resource Operation Logs tab.

The following is a raw log sample for a RunCommand event.

{
    "acsRegion": "cn-hangzhou",
    "additionalEventData": {
        "CallerBid": "26842"
    },
    "apiVersion": "2014-05-26",
    "eventCategory": "Management",
    "eventId": "7BC2AF40-593B-52B3-A8A8-xxx",
    "eventName": "RunCommand",
    "eventRW": "Write",
    "eventSource": "ecs-cn-hangzhou.aliyuncs.com",
    "eventTime": "2024-08-22T06:01:19Z",
    "eventType": [
        "spec"
    ],
    "eventVersion": "1",
    "recipientAccountId": "156xxx",
    "referencedResources": {
        "ACS::ECS::Instance": [
            "i-xxx-kgwv77e77"
        ],
        "ACS::ECS::Invocation": [
            "t-xxx-s"
        ],
        "ACS::ECS::Command": [
            ...
        ]
    }
}

Screen recording

For private services and fully managed services, you can enable the Workbench screen recording feature. This records all operations in Workbench, facilitating effective operation audits.

Configure screen recording in the Compute Nest console.
In the navigation pane on the left, click Settings. On the O&M Settings page, turn on the Enable screen recording for remote connections switch. Then, configure the OSS bucket (select a region and bucket), Screen recording save path, and Screen recording retention period (days). Click Save.
Watch video playback for a service instance.
Click the Log Management tab, and then click the Resource Operation Logs subtab. In the upper-right corner of the page, click Watch video playback.
View specific operation records as needed.
The session management page provides Search and Advanced search functions. The table includes columns such as No., User ID, Start/end time, Host/port, Instance name/instance ID, Online duration, Protocol/ID, Browser, and Actions. Each column is filterable.