This topic describes the fields in the Layer 7 access logs of Classic Load Balancer (CLB), Cloud Config logs, and CloudMonitor events.
Access logs
Field | Description |
__topic__ | The topic of the log. The value is fixed as slb_layer7_access_log. |
body_bytes_sent | The number of bytes in the HTTP body sent to the client. |
client_ip | The IP address of the client that sent the request. |
host | The host. The value is first obtained from the request parameters. If not found, the value is obtained from the Host header. If still not found, the IP address of the backend server that processes the request is used. |
http_host | The content of the Host header in the request message. |
http_referer | The content of the Referer header in the HTTP request message received by the proxy. |
http_user_agent | The content of the User-Agent header in the HTTP request message received by the proxy. |
http_x_forwarded_for | The content of the X-Forwarded-For header in the request message received by the proxy. |
http_x_real_ip | The real IP address of the client. |
read_request_time | The time taken by the proxy to read the request. Unit: milliseconds. |
request_length | The length of the request message, including the start line, HTTP header, and HTTP body. |
request_method | The method of the request message. |
request_time | The interval between the time when the proxy receives the first request message and the time when the proxy returns a response. Unit: seconds. |
request_uri | The URI of the request message received by the proxy. |
scheme | The schema of the request, such as http or https. |
server_protocol | The version of the HTTP protocol received by the proxy, such as HTTP/1.0 or HTTP/1.1. |
slb_vport | The listener port of the SLB instance. |
slbid | The ID of the SLB instance. |
ssl_cipher | The cipher used to establish the SSL connection, such as ECDHE-RSA-AES128-GCM-SHA256. |
ssl_protocol | The protocol used to establish the SSL connection, such as TLSv1.2. |
status | The status code of the response message from the proxy. |
tcpinfo_rtt | The TCP connection time of the client. Unit: microseconds. |
time | The time when the log was recorded. |
upstream_addr | The IP address and port of the backend server. |
upstream_response_time | The time from when the SLB instance establishes a connection to the backend server until it receives all data and closes the connection. Unit: seconds. |
upstream_status | The response status code that the proxy received from the backend server. |
vip_addr | The virtual IP address. |
write_response_time | The duration, in milliseconds, for the proxy to send a request to the client after receiving it from the backend. |
Audit configuration logs
Configuration change records
Field
Description
accountId
The ID of the Alibaba Cloud account to which the resource belongs.
arn
The identity of the RAM role.
availabilityZone
The zone where the resource is located.
captureTime
The timestamp when the resource compliance evaluation is recorded. Unit: milliseconds.
configuration
The list of rules associated with the resource and the compliance details of the rules.
configurationDiff
The details of the resource change that triggered this evaluation.
dataType
The event type. The value is fixed as ConfigurationItemChangeNotification.
regionId
The region ID.
relationship
The details of related resources. The details include the region ID, resource relationship, resource ID, and resource type.
relationshipDiff
The details of the resource change that triggered this evaluation.
requestId
The request ID.
resourceCreateTime
The timestamp when the resource was created. Unit: milliseconds.
resourceEventType
The resource event.
resourceGroupId
The resource group.
resourceId
The resource ID.
realResourceId
The ID of the level-1 resource.
resourceName
The resource name.
resourceStatus
The resource status.
resourceType
The resource type.
serviceName
The service name.
tags
The resource tags.
version
The version number.
Resource non-compliance events
Field
Description
accountId
The ID of the Alibaba Cloud account to which the resource belongs.
annotation
The description.
riskLevel
The threat level. Valid values include the following: 1: high threat. 2: medium threat. 3: low threat.
dataType
A non-compliance event. The value is fixed as NonCompliantNotification.
evaluationResultIdentifier
The identifier of the resource evaluation result.
eventType
The event type.
invokingEventMessageType
The trigger mechanism of the rule.
complianceType
The compliance evaluation result of the rule. Valid values include the following: COMPLIANT: The resource is compliant. NON_COMPLIANT: The resource is non-compliant. NOT_APPLICABLE: The rule does not apply to the resource. INSUFFICIENT_DATA: No data is available.
requestId
The request ID.
eventName
The event name.
notificationCreationTime
The time when the notification was created.
regionId
The region ID.
resourceId
The resource ID.
resourceType
The resource type.
serviceName
The service name.
CloudMonitor events
Field | Description |
event_id | The ID of the CloudMonitor event. |
source | The event source. This typically includes the type of the event source, the event publishing mechanism, or the event generation procedure. |
version | The CloudEvents protocol version. |
publish_time | The time when the event was pushed. |
type | The event type, which describes the event type related to the event source. |
data | The content of the event. This is a JSON object. The content is determined by the service that initiated the event. |
data_type | A CloudMonitor event. |
region | The region where the event occurred. |
account_id | The ID of the Alibaba Cloud account to which the event belongs. |