DocsICP FilingConsole
官方文档
首页

DescribeAuditLogs

更新时间：
复制 MD 格式
产品详情
我的收藏

Retrieves a list of audit alert logs.

Operation description

This operation queries a list of data audit alert logs, allowing you to search for and handle alerts.

QPS limit

The QPS limit for a single user is 10. If you exceed this limit, the system throttles your API calls. Plan your calls accordingly.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

  • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

  • API: The API that you can call to perform the action.

  • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

  • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

    • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

    • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

  • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

  • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sddp:DescribeAuditLogs

none

*All Resource

*
  • acs:ResourceGroupId
 None

Request parameters

Parameter

Type

Required

Description

Example
Lang

string

No

Specifies the language of the request and response. Default value: zh_cn. Valid values:

  • zh_cn: Chinese.

  • en_us: English.

zh
UserName

string

No

The username.

admin
ClientIp

string

No

The client IP address.

10.*.*.94
ClientUa

string

No

The client type.

mysql
InstanceName

string

No

The name of the data asset instance.

i-2zeftaaq4gqcqb9kfkzg
DatabaseName

string

No

The database name.

bose_o2o_data
StartTime

integer

No

The start time for querying alert logs, provided as a UNIX timestamp in milliseconds.

1616068534877
EndTime

integer

No

The end time for querying alert logs, provided as a UNIX timestamp in milliseconds.

1583856000000
ProductCode

string

No

The service to which the data asset belongs. Valid values include MaxCompute, OSS, AnalyticDB for MySQL, TableStore, and RDS.

RDS
ProductId

integer

No

The ID of the service to which the data object belongs. Valid values:

  • 1: MaxCompute

  • 2: OSS

  • 3: AnalyticDB for MySQL

  • 4: TableStore

  • 5: RDS

  • 6: SELF_DB

  • 7: PolarDB-X

  • 8: PolarDB

  • 9: AnalyticDB for PostgreSQL

  • 10: OceanBase

  • 11: MongoDB

  • 25: Redis

5
SqlText

string

No

The SQL statement.

select * from test03
ExecuteTimeRange

string

No

The execution time range.

in[1000 2000]
EffectRowRange

string

No

The range of affected rows.

in[1 33]
RuleID

string

No

The ID of the audit rule.

994007
RuleName

string

No

The name of the audit rule.

test_rule
OperateType

string

No

The operation type.

Insert
OssObjectKey

string

No

The key of the OSS object.

oss-key
AsyncRequestId

string

No

The request ID.

CE4681BA-8019-5BE1-9F4B-8973BEA9CF57
PageSize

integer

No

The number of entries per page. Maximum value: 50. Default value: 10.

10
CurrentPage

integer

No

The page number to return. Default value: 1.

1
RuleCategory

string

No

The rule type.

10
LoadWhiteList

boolean

No

Specifies whether to retrieve the whitelist status.

false
MemberAccount

string

No

The UID of the member account.

**********8103
IpType

string

No

The network type. Valid values:

  • default: The IP address is from outside of Alibaba Cloud. This is the default value.

  • aliyun: The IP address is from within Alibaba Cloud.

aliyun
LogQueryOpJson

string

No

A JSON string that specifies which query conditions to include or exclude.

[ { "isContain" : false, "queryKey" : "effectRowRange" }, { "isContain" : false, "queryKey" : "remoteClientIp" } ]
Message

string

No

The message content.

success
LogSource

string

No

The data source.

SLOW_SQL
RuleAggQuery

boolean

No

Specifies whether to perform an aggregate query.

true
RuleId

string

No

The ID of the audit rule.

867028

Response elements

Element

Type

Description

Example

object

AsyncRequestId

string

The request ID.

CE4681BA-8019-5BE1-9F4B-8973BEA9CF57

CurrentPage

integer

The current page number. Default value: 1.

1
PageSize

integer

The number of entries per page. Maximum value: 50. Default value: 10.

10
RequestId

string

The request ID.

A7021857-AFD9-5AD6-979D-AA7DFC5AFADF
TotalCount

integer

The total number of entries returned.

12
Items

array<object>

An array of alert logs.

object

The details of an alert log.

CreationTime

integer

The time when the alert was generated. This value is a UNIX timestamp in milliseconds.

1536751124000
WarnLevel

string

The risk level. Valid values:

  • 1: Low

  • 2: Medium

  • 3: High

2
ClientPort

string

The client port.

35756
TableName

string

The name of the table.

it_table
EffectRow

integer

The number of affected rows.

10
PackageName

string

The name of the MaxCompute package.

test01
UserId

string

The ID of the user.

19********94
Message

string

The raw log content.

success
RuleId

string

The ID of the audit rule.

9952275
OperateType

string

The operation type.

Drop
LogTime

integer

The time when the operation was logged. This value is a UNIX timestamp in milliseconds.

1751870592000
WarnLevelName

string

The name of the risk level. Valid values:

  • Low

  • Medium

  • High

高危
InstanceName

string

The name of the data asset.

rm-1234
DatabaseName

string

The name of the database.

chngc_b2b_migration_sh
OssObjectKey

string

The key of the OSS object.

oss-key1
ExecuteStatus

integer

The execution status. Valid values: 0 (failed) and 1 (successful).

1
ProductId

integer

The ID of the Alibaba Cloud service that contains the data asset. Valid values:

  • 1: MaxCompute

  • 2: OSS

  • 3: ADS

  • 4: OTS

  • 5: RDS

  • 6: SELF_DB

5
ExecuteTime

integer

The execution duration in milliseconds.

1751870592000
UserName

string

The name of the user.

admin
InstanceDescription

string

The description of the data asset.

instance dscription
RuleName

string

The name of the audit rule.

name
ColumnName

string

The name of the column.

hide14
ClientIp

string

The client IP address.

139.*.*.57
ClientUa

string

The user agent of the client.

mysql
ProductCode

string

The code of the Alibaba Cloud service. Examples: MaxCompute, OSS, ADS, OTS, and RDS.

RDS
SqlText

string

The SQL statement in the alert log.

select * from test03

InWhiteList

boolean

Indicates whether the operation is whitelisted.

true
MemberAccount

string

The ID of the member.

**********8103
RuleCategory

string

The type of the rule.

10
IpType

string

The network type. Valid values:

default: a non-Alibaba Cloud service. This is the default value.

aliyun: an Alibaba Cloud service.

aliyun
ModelName

string

The sensitive data detection rule that was matched.

Identity Card
DataSet

string

The SQL result set.

plan_id ~ application_id ~ plan_type ~ plan_name ~ plan_value_id
LogSource

string

The data source.

SLOW_SQL
InstanceAuditStatus

string

The audit status of the instance.

2
DbType

string

The type of the database.

MySQL

Examples

Success response

JSON format

{
  "AsyncRequestId": "CE4681BA-8019-5BE1-9F4B-8973BEA9CF57\n",
  "CurrentPage": 1,
  "PageSize": 10,
  "RequestId": "A7021857-AFD9-5AD6-979D-AA7DFC5AFADF",
  "TotalCount": 12,
  "Items": [
    {
      "CreationTime": 1536751124000,
      "WarnLevel": "2",
      "ClientPort": "35756",
      "TableName": "it_table",
      "EffectRow": 10,
      "PackageName": "test01",
      "UserId": "19********94",
      "Message": "success",
      "RuleId": "9952275",
      "OperateType": "Drop",
      "LogTime": 1751870592000,
      "WarnLevelName": "高危",
      "InstanceName": "rm-1234",
      "DatabaseName": "chngc_b2b_migration_sh",
      "OssObjectKey": "oss-key1",
      "ExecuteStatus": 1,
      "ProductId": 5,
      "ExecuteTime": 1751870592000,
      "UserName": "admin",
      "InstanceDescription": "instance dscription",
      "RuleName": "name",
      "ColumnName": "hide14",
      "ClientIp": "139.*.*.57",
      "ClientUa": "mysql",
      "ProductCode": "RDS",
      "SqlText": "select * from test03\n",
      "InWhiteList": true,
      "MemberAccount": "**********8103",
      "RuleCategory": "10",
      "IpType": "aliyun",
      "ModelName": "Identity Card",
      "DataSet": "plan_id ~ application_id ~ plan_type ~ plan_name ~ plan_value_id",
      "LogSource": "SLOW_SQL",
      "InstanceAuditStatus": "2",
      "DbType": "MySQL",
      "RamConsoleLink": ""
    }
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.