How to query KMS system events and set up alerts-Key Management Service(KMS)-阿里云帮助中心

Key Management Service (KMS) integrates with Cloud Monitor (CMS) to monitor system events and provide alerts. This integration helps you stay informed about events and handle them promptly. This topic describes how to query system events and set alerts.

KMS system event types

System events do not require manual configuration. When the trigger conditions for a system event are met, the event is automatically displayed in the KMS console and the CloudMonitor console. To receive alert notifications for events, you can set them in the CloudMonitor console. For more information, see Set alert notifications for system events.

System event	Event level	Trigger condition
QPS has reached 90%	CRITICAL	This event is triggered when the real-time queries per second (QPS) of a KMS instance reaches 90% of its quota.
Key scheduled for deletion	WARN	This event is triggered when a key is scheduled for deletion.
Key deleted	WARN	This event is triggered when a key is deleted.
Secret scheduled for deletion	WARN	This event is triggered when a secret is scheduled for deletion.
Secret deleted	WARN	This event is triggered when a secret is deleted.
Managed secret rotation failed	CRITICAL	This event is triggered when a secret rotation fails.
Managed secret rotation succeeded	INFO	This event is triggered when a secret rotation succeeds.
Key sync failed	CRITICAL	This event is triggered when a key in a KMS instance fails to sync across regions. For more information, see Cross-region synchronization.
Key sync succeeded	INFO	This event is triggered when a key in a KMS instance successfully syncs across regions. For more information, see Cross-region synchronization.
ClientKey expiration reminder	CRITICAL	This event is triggered 180, 90, 30, and 7 days before a ClientKey expires. For more information about ClientKeys, see Overview of application access points.
QPS has reached 70%	INFO	This event is triggered when the real-time QPS of a KMS instance reaches 70%. If the limit is exceeded, KMS may become inaccessible and affect business continuity.
Access management usage has reached 70%	INFO	This event is triggered when the access management usage of a KMS instance reaches 70%. If the limit is exceeded, you cannot create new access management policies.
Access management usage has reached 90%	WARN	This event is triggered when the access management usage of a KMS instance reaches 90%. If the limit is exceeded, you cannot create new access management policies.
Key usage has reached 70%	INFO	This event is triggered when the key usage of a KMS instance reaches 70%. If the limit is exceeded, you cannot create new keys.
Key usage has reached 90%	WARN	This event is triggered when the key usage of a KMS instance reaches 90%. If the limit is exceeded, you cannot create new keys.
Log analysis log volume has reached 70%	INFO	This event is triggered when the log analysis log volume of a KMS instance reaches 70%. If the limit is exceeded, new logs cannot be written.
Log analysis log volume has reached 90%	WARN	This event is triggered when the log analysis log volume of a KMS instance reaches 90%. If the limit is exceeded, new logs cannot be written.
Secret usage has reached 70%	INFO	This event is triggered when the Secret usage of a KMS instance reaches 70%. If the limit is exceeded, you cannot create new secrets.
Secret usage has reached 90%	WARN	This event is triggered when the secret usage of a KMS instance reaches 90%. If the limit is exceeded, you cannot create new secrets.

Supported CloudMonitor metrics

Metric	Description	Alerting supported	Dimensions	Statistics
Requests per minute for an instance	The total number of requests the instance receives per minute.	Yes	userId, regionId, instanceId	Value
Symmetric encryption/decryption requests per minute	The total number of symmetric operation requests per minute.	Yes	userId, regionId, instanceId	Value
Asymmetric encryption requests per minute	The total number of asymmetric encryption requests per minute.	Yes	userId, regionId, instanceId	Value
Asymmetric decryption requests per minute	The total number of asymmetric decryption requests per minute.	Yes	userId, regionId, instanceId	Value
Asymmetric signing requests per minute	The total number of asymmetric signing requests per minute.	Yes	userId, regionId, instanceId	Value
Asymmetric signature verification requests per minute	The total number of asymmetric signature verification requests per minute.	Yes	userId, regionId, instanceId	Value
Secret operation requests per minute	The total number of secret requests per minute.	Yes	userId, regionId, instanceId	Value
Other requests per minute	The total number of other operation requests per minute.	Yes	userId, regionId, instanceId	Value
5xx error requests	The number of requests per minute that result in a 5xx error code.	Yes	userId, regionId, instanceId	Value
4xx error requests	The number of requests per minute that result in a 4xx error code.	Yes	userId, regionId, instanceId	Value
Request latency	The average latency of all requests in one minute.	Yes	userId, regionId, instanceId	Value
KMS instance CPU utilization	The instance's CPU utilization as a percentage.	Yes	userId, instanceId	Value
KMS instance symmetric QPS utilization	The instance's symmetric QPS utilization, as a percentage of its total capacity.	Yes	userId, instanceId	Value
KMS instance asymmetric QPS utilization	The instance's asymmetric QPS utilization, as a percentage of its total capacity.	Yes	userId, instanceId	Value

View system events

You can view system events from the last 90 days.

Method 1: View in the KMS console
1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Alert Events.
2. On the CloudMonitor Alerts tab, select an event type and a time range. For example, you can select Key scheduled for deletion from the event type filter box. Event types include: QPS is about to reach the limit, Key scheduled for deletion, Key deleted, Credential scheduled for deletion, Credential deleted, Managed credential rotation failed, Managed credential rotation succeeded, and Key sync failed.
3. In the Actions column, click Details to view the event details.
Method 2: View in the CloudMonitor console
1. Log on to the Cloud Monitor console.
2. In the navigation pane on the left, choose Event Center > System Event.
3. On the Event Monitoring tab, set Product to Key Management Service, select the event level, event name, and time period, and then click Search.
4. In the event list, click Details in the Actions column for the target event.

Set alert notifications for system events

You can set alert rules for system events to receive prompt notifications when exceptions occur. This helps you quickly analyze and locate issues. You can set these rules only in the CloudMonitor console.

Log on to the Cloud Monitor console.
In the navigation pane, choose Event Center > System Event.
On the Event Monitoring tab, click Save as Alert Rule.

Note
To perform custom processing on alert notifications, such as merging and noise reduction, configure the notifications on the Event Subscription page. For more information, see Manage event subscriptions (recommended).
In the Create/Modify Event-triggered Alert Rule panel, configure the alert settings.

Note
For more information about the configuration items, see Create an alert rule for a system event.

View statistical data

For information about configuring KMS CloudMonitor alerts and viewing CloudMonitor statistics, see Overview.