Log fields

ActionTrail

• Field details

  Log field	Description
  __topic__	The topic of the log entry. Valid values: actiontrail_event.
  owner_id	The ID of the Alibaba Cloud account.
  event	The log event in the JSON format. The content of this field varies depending on the log event.
  event.eventId	The unique ID of the event.
  event.eventName	The name of the event.
  event.eventSource	The source of the event.
  event.eventType	The type of the event.
  event.eventVersion	The data format version of the event. Valid values: 1.
  event.acsRegion	The region where the event occurs.
  event.requestId	The ID of the API request.
  event.apiVersion	The version of the API.
  event.errorMessage	The error message of the event.
  event.serviceName	The name of the Alibaba Cloud service associated with the event.
  event.sourceIpAddress	The source IP address that is associated with the event.
  event.userAgent	The client that introduces the event.
  event.requestParameters.HostId	The ID of the host from which the request originates.
  event.requestParameters.Name	The name of the request parameter.
  event.requestParameters.Region	The region from which the request originates
  event.userIdentity.accessKeyId	The AccessKey ID of the logon account.
  event.userIdentity.accountId	The ID of the Alibaba Cloud account.
  event.userIdentity.principalId	The ID of the logon account.
  event.userIdentity.type	The identity type of the logon account.
  event.userIdentity.userName	The username of the logon account.
  event.errorCode	The error code of the event.
  addionalEventData.isMFAChecked	Indicates whether MFA is enabled for the logon account that is used to log on to Log Service.
  addionalEventData.loginAccount	The account used to log on to Log Service.

• Sample log entry

  {
    "acsRegion": "cn-hangzhou",
    "additionalEventData": {
      "isMFAChecked": "false",
      "loginAccount": "test1234@aliyun.com"
    },
    "eventId": "7be1e173-1234-44a1-b135-1234",
    "eventName": "ConsoleSignin",
    "eventSource": "http://account.aliyun.com:443/login/login_aliyun.htm",
    "eventTime": "2018-07-12T06:14:50Z",
    "eventType": "ConsoleSignin",
    "eventVersion": "1",
    "requestId": "7be1e173-1234-44a1-b135-1234",
    "serviceName": "AasCustomer",
    "sourceIpAddress": "42.120.75.137",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36",
    "userIdentity": {
      "accessKeyId": "25****************",
      "accountId": "1234",
      "principalId": "1234",
      "type": "root-account",
      "userName": "root"
    }
  }
  
                      

Server Load Balancer (SLB)

API Gateway

Web Application Firewall (WAF)

Security Center

• Network logs
  • DNS logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: sas-log-dns.
    owner_id	The ID of the Alibaba Cloud account.
    additional	The fields in the additional section. Each field is separated by a vertical bar (|).
    additional_num	The number of fields in the additional section.
    answer	The DNS answers. Each DNS answer is separated by a vertical bar (|).
    answer_num	The number of DNS answers.
    authority	The fields in the authority section.
    authority_num	The number of fields in the authority section.
    client_subnet	The subnet where the client resides.
    dst_ip	The destination IP address.
    dst_port	The destination port.
    in_out	The direction of data flows. Valid values: in: inbound data flows out: outbound data flows
    qid	The ID of the query.
    qname	The domain name to be queried.
    qtype	The type of the resource to be queried.
    query_datetime	The timestamp of the query. Unit: milliseconds.
    rcode	The code of the response.
    region	The ID of the source region. Valid values: 1: Beijing 2: Qingdao 3: Hangzhou 4: Shanghai 5: Shenzhen 6: Others
    response_datetime	The timestamp of the response. The timestamp is in the datetime format.
    src_ip	The source IP address.
    src_port	The source port.

  • Local DNS logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: local-dns.
    owner_id	The ID of the Alibaba Cloud account.
    answer_rda	The DNS answers. Each DNS answer is separated by a vertical bar (|).
    answer_ttl	The TTL of resource records in the DNS answers. Each value is separated by a vertical bar (|).
    answer_type	The types of resource records in the DNS answers. Each value is separated by a vertical bar (|).
    anwser_name	The domain names in the DNS answers. Each value is separated by a vertical bar (|).
    dest_ip	The destination IP address.
    dest_port	The destination port.
    group_id	The ID of the group to which the host belongs.
    hostname	The hostname.
    id	The IP address of the host.
    instance_id	The ID of the ECS instance.
    internet_ip	The public IP address of the host.
    ip_ttl	The TTL of the data packets sent by the host.
    query_name	The domain name to be queried.
    query_type	The type of the resource to be queried.
    src_ip	The source IP address.
    src_port	The source port.
    time	The time of the query. The time is in the UNIX timestamp format.
    time_usecond	The response duration. Unit: microseconds.
    tunnel_id	The ID of the DNS tunnel.

  • Network session logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: sas-log-session.
    owner_id	The ID of the Alibaba Cloud account.
    asset_type	The type of the associated Alibaba Cloud service, for example, ECS, SLB, and ApsaraDB for RDS.
    dst_ip	The destination IP address.
    dst_port	The destination port.
    proto	The type of the transport layer protocol, for example, TCP and UDP.
    session_time	The time of the TCP session.
    src_ip	The source IP address.
    src_port	The source port.

  • Web logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: sas-log-http.
    owner_id	The ID of the Alibaba Cloud account.
    content_length	The content length of the HTTP request message.
    dst_ip	The destination IP address.
    dst_port	The destination port.
    host	The hostname of the web server.
    jump_location	The HTTP redirect.
    method	The HTTP request method.
    referer	The Referer HTTP header. The field contains the address of the web page which is linked to the resource being requested.
    request_datetime	The time of the request. The time is in the datetime format.
    ret_code	The HTTP status code.
    rqs_content_type	The content type of the HTTP request message.
    rsp_content_type	The content type of the HTTP response message.
    src_ip	The source IP address.
    src_port	The source port.
    uri	The request URI.
    user_agent	The client that initiates the request.
    x_forward_for	The x-forwarded-for HTTP header.

• Security logs
  • Vulnerability logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: sas-vul-log.
    owner_id	The ID of the Alibaba Cloud account.
    name	The name of the vulnerability.
    alias_name	The alias of the vulnerability.
    op	The action about the vulnerability. new: A new vulnerability is detected. verify: Verifies the vulnerability. fix: Fixes the vulnerability.
    status	The status of the vulnerability. For more information, see Table 2.
    tag	The vulnerability tag, for example, oval, system, and cms. The field can be used to distinguish emergency (EMG) vulnerabilities.
    type	The type of the vulnerability. sys: Windows vulnerability cve: Linux vulnerability cms: Web CMS vulnerability EMG: Emergency vulnerability
    uuid	The UUID of the client.

  • Baseline logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: sas-hc-log.
    owner_id	The ID of the Alibaba Cloud account.
    level	The level of the baseline check. Valid values: low, medium, and high.
    op	The action about the vulnerability. new: A new vulnerability is detected. verify: Verifies the baseline check.
    risk_name	The name of the check item.
    status	The status of the check item. For more information, see Table 2.
    sub_type_alias	The subtype alias of the check item.
    sub_type_name	The subtype of the check item.
    type_name	The type of the check item.
    type_alias	The type alias of the check item.
    uuid	The UUID of the client.

    Table 1. Types and subtypes of check items

    type_name	sub_type_name
    system	baseline
    weak_password	postsql_weak_password
    database	redis_check
    account	system_account_security
    account	system_account_security
    weak_password	mysq_weak_password
    weak_password	ftp_anonymous
    weak_password	rdp_weak_password
    system	group_policy
    system	register
    account	system_account_security
    weak_password	sqlserver_weak_password
    system	register
    weak_password	ssh_weak_password
    weak_password	ftp_weak_password
    cis	centos7
    cis	tomcat7
    cis	memcached-check
    cis	mongodb-check
    cis	ubuntu14
    cis	win2008_r2
    system	file_integrity_mon
    cis	linux-httpd-2.2-cis
    cis	linux-docker-1.6-cis
    cis	SUSE11
    cis	redhat6
    cis	bind9.9
    cis	centos6
    cis	debain8
    cis	redhat7
    cis	SUSE12
    cis	ubuntu16

    Table 2. Status codes of security logs

    Status code	Description
    1	Unfixed.
    2	Fix failed.
    3	Rollback failed.
    4	Fixing.
    5	Rolling back.
    6	Verifying.
    7	Fixed.
    8	Fixed. To be restarted.
    9	Rollback succeeded.
    10	Ignored.
    11	Rollback succeeded. To be restarted.
    12	Does not exist.
    20	Expired.

  • Security alert logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: sas-security-log.
    owner_id	The ID of the Alibaba Cloud account.
    data_source	The source of the data. For more information, see Table 3.
    level	The severity of the alert.
    name	The name of the alert, for example, Suspicious Process-SSH-based Remote Execution of Non-interactive Commands.
    op	The action about the vulnerability. new: An alert is triggered. dealing: The alert is being processed.
    status	The status of the alert. For more information, see Table 2.
    uuid	The UUID of the client.

    Table 3. Values of the data_source field in security alert logs

    Value	Description
    aegis_suspicious_event	Server exceptions
    aegis_suspicious_file_v2	Webshell
    aegis_login_log	Suspicious logon
    security_event	Security Center exceptions

• Host logs
  • Process initiation logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: aegis-log-process.
    owner_id	The ID of the Alibaba Cloud account.
    uuid	The UUID of the client.
    ip	The IP address of the client.
    cmdline	The full command line to start the process.
    username	The username.
    uid	The ID of the user.
    pid	The ID of the process.
    filename	The name of the process file.
    filepath	The full path of the process file.
    groupname	The name of the user group.
    ppid	The ID of the parent process.
    pfilename	The name of the parent process file.
    pfilepath	The full path of the parent process file.

  • Process snapshot logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: aegis-snapshot-process.
    owner_id	The ID of the Alibaba Cloud account.
    uuid	The UUID of the client.
    ip	The IP address of the client.
    cmdline	The full command line to start the process.
    pid	The ID of the process.
    name	The name of the process file.
    path	The full path of the process file.
    md5	The MD5 hash of the process file. The MD5 hash is not performed if the process file exceeds 1 MB.
    pname	The file name of the parent process.
    start_time	The time when the process starts. This field is a built-in field.
    user	The username.
    uid	The ID of the user.

  • Logon logs
    Logon attempts within one minute are recorded in one log entry.

    Log field	Description
    __topic__	The topic of the log entry. Valid values: aegis-log-login.
    owner_id	The ID of the Alibaba Cloud account.
    uuid	The UUID of the client.
    ip	The IP address of the client.
    warn_ip	The source IP address.
    warn_port	The logon port.
    warn_type	The type of the logon. Valid values: SSHLOGIN, RDPLOGIN, and IPCLOGIN.
    warn_user	The logon username.
    warn_count	The number of logon attempts. A value of 3 indicates that two logon requests are sent one minute before the current logon.

  • Brute-force cracking logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: aegis-log-crack.
    owner_id	The ID of the Alibaba Cloud account.
    uuid	The UUID of the client.
    ip	The IP address of the client.
    warn_ip	The source IP address.
    warn_port	The logon port.
    warn_type	The type of the logon. Valid values: SSHLOGIN, RDPLOGIN, and IPCLOGIN.
    warn_user	The logon username.
    warn_count	The number of failed logon attempts.

  • Network connection logs
    Changes in network connections are collected on the host every 10 seconds to 1 minute.

    Log field	Description
    __topic__	The topic of the log entry. Valid values: aegis-log-network.
    owner_id	The ID of the Alibaba Cloud account.
    uuid	The UUID of the client.
    ip	The IP address of the client.
    src_ip	The source IP address.
    src_port	The source port.
    dst_ip	The destination IP address.
    dst_port	The destination port.
    proc_name	The name of the process.
    proc_path	The path of the process file.
    proto	The protocol used to establish a network connection, for example, TCP, UDP, and raw (raw socket).
    status	The connection status. For more information, see Table 4.

    Table 4. Status codes of network connections

    Status code	Description
    1	closed
    2	listen
    3	syn send
    4	syn recv
    5	establisted
    6	close wait
    7	closing
    8	fin_wait1
    9	fin_wait2
    10	time_wait
    11	delete_tcb

  • Port listening snapshot logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: aegis-snapshot-port.
    owner_id	The ID of the Alibaba Cloud account.
    uuid	The UUID of the client.
    ip	The IP address of the client.
    proto	The protocol that is used to establish a network connection, for example, TCP, UDP, and raw (raw socket).
    src_ip	The IP address of the listener port.
    src_port	The listener port.
    pid	The ID of the process.
    proc_name	The name of the process.

  • Account snapshot logs

    Log field	Description
    __topic__	The topic of the log entry. Valid values: aegis-snapshot-host.
    owner_id	The ID of the Alibaba Cloud account.
    name	The name of the vulnerability.
    alias_name	The alias of the vulnerability.
    op	The action about the vulnerability. new: A new vulnerability is detected. verify: Verifies the vulnerability. fix: Fixes the vulnerability.
    status	The status of the account. For more information, see Table 4.
    tag	The vulnerability tag, for example, oval, system, and cms. The field can be used to distinguish emergency (EMG) vulnerabilities.
    type	The type of the vulnerability. sys: Windows vulnerability cve: Linux vulnerability cms: Web CMS vulnerability EMG: Emergency vulnerability
    uuid	The UUID of the client.

Distributed Relational Database Service

Cloud Firewall

Bastionhost

OSS

• Access logs

  Log field	Description
  __topic__	The topic of the log entry. Valid values: oss_access_log.
  owner_id	The ID of the Alibaba Cloud account.
  region	The region where the bucket resides.
  access_id	The AccessKey ID of the Alibaba Cloud account.
  time	The time when OSS receives a request. Use the value of __time__ if a timestamp is required.
  owner_id	The Alibaba Cloud account ID of the bucket owner.
  User-Agent	The HTTP User-Agent header.
  logging_flag	Indicates whether logging has been enabled to periodically export logs to OSS buckets.
  bucket	The name of the bucket.
  content_length_in	The value of the request Content-Length header. Unit: bytes.
  content_length_out	The value of response Content-Length header. Unit: bytes.
  object	The requested URL-encoded object. You can include the select url_decode(object) clause in a query statement to decode the object.
  object_size	The size of a requested object. Unit: bytes.
  operation	The API operation. For more information, see Table 7.
  request_uri	The URL-encoded URI of a request, including the query_string parameter. You can include the select url_decode(request_uri) clause in a query statement to decode the URI.
  error_code	The error code returned by OSS. For more information, see OSS error response.
  request_length	The size of the HTTP request message. Unit: bytes.
  client_ip	The IP address from which a request originates. The IP address can be the IP address of the client, firewall, or proxy.
  response_body_length	The size of the HTTP response body.
  http_method	The HTTP request method.
  referer	The Referer HTTP header.
  requester_id	The ID of the Alibaba Cloud account. The value of this field is a hyphen (-) if you use anonymous logon.
  request_id	The ID of the request.
  response_time	The response duration. Unit: milliseconds.
  server_cost_time	The time that the OSS server consumes to process a request. Unit: milliseconds.
  http_type	The protocol of an HTTP request. Valid values: HTTP and HTTPS.
  sign_type	The type of the signature. For more information, see Table 9.
  http_status	The HTTP status code returned by the OSS server.
  sync_request	The type of the synchronization request. For more information, see Table 8.
  bucket_storage_type	The OSS storage class. For more information, see Table 6.
  host	The domain name of the OSS server from which resources are requested.
  vpc_addr	The VPC IP address of the OSS server. The IP address is resolved from the domain name of the server.
  vpc_id	VPC ID
  delta_data_size	The size change of the object. The value of this field is 0 if the object size does not change. The value of this field is a hyphen (-) if the request is not an upload request.
  acc_access_region	For a transfer acceleration request, this field is the ID of the region where the requested access point resides. Otherwise, The value of this field is a hyphen (-).

• Batch deletion logs

  Log field	Description
  __topic__	The topic of the log entry. Valid values: oss_batch_delete_log.
  owner_id	The ID of the Alibaba Cloud account.
  region	The region where the bucket resides.
  client_ip	The IP address from which a request originates. The IP address can be the IP address of the client, firewall, or proxy.
  user_agent	The HTTP User-Agent header.
  bucket	The name of the bucket.
  error_code	The error code returned by OSS. For more information, see OSS error response.
  request_length	The size of the HTTP request message. Unit: bytes.
  response_body_length	The size of the HTTP response body.
  object	The requested URL-encoded object. You can include the select url_decode(object) clause in a query statement to decode the object.
  object_size	The size of the requested object. Unit: bytes.
  operation	The API operation. For more information, see Table 7.
  bucket_location	The cluster to which the bucket belongs.
  http_method	The HTTP request method.
  referer	The Referer HTTP header.
  request_id	The ID of the request.
  http_status	The HTTP status code that OSS returns.
  sync_request	The type of the synchronization request. For more information, see Table 8.
  request_uri	The URL-encoded URI of a request, including the query_string parameter. You can include the select url_decode(request_uri) clause in a query statement to decode the URI.
  host	The domain name of the OSS server from which resources are requested.
  logging_flag	Indicates whether logging has been enabled to periodically export logs to OSS buckets.
  server_cost_time	The time that the OSS server consumes to process a request. Unit: milliseconds.
  owner_id	The Alibaba Cloud account ID of the bucket owner.
  requester_id	The Alibaba Cloud ID of the requester. The value of this field is a hyphen (-) for anonymous requests.
  delta_data_size	The variation of the size of the object. The value of this field is 0 if the object size does not change. The value of this field is a hyphen (-) if the request is not an upload request.

• Hourly metering logs

  Log field	Description
  __topic__	The topic of the log entry. Valid values: oss_metering_log.
  owner_id	The Alibaba Cloud account ID of the bucket owner.
  bucket	The name of the bucket.
  cdn_in	The inbound traffic from CDN. Unit: bytes.
  cdn_out	The outbound traffic to CDN. Unit: bytes.
  get_request	The number of GET requests.
  intranet_in	The inbound traffic from the internal network. Unit: bytes.
  intranet_out	The outbound traffic of the internal network. Unit: bytes.
  network_in	The inbound traffic from the public network. Unit: bytes.
  network_out	The outbound traffic to the public network. Unit: bytes.
  put_request	The number of PUT requests.
  storage_type	The OSS storage class. For more information, see Table 6.
  storage	The storage usage of the bucket. Unit: bytes.
  metering_datasize	The size of metering data in non-standard storage.
  process_img_size	The size of the processed image. Unit: bytes.
  process_img	The processed image.
  sync_in	The inbound synchronization traffic. Unit: bytes.
  sync_out	The outbound synchronization traffic. Unit: bytes.
  start_time	The time when a metering operation starts. The time is in the UNIX timestamp format.
  end_time	The time when a metering operation ends. The time is in the UNIX timestamp format.
  region	The region where the bucket resides.

ApsaraDB for RDS

Apsara File Storage NAS

Alibaba Cloud Mobile Push