Use DLA to query and analyze events delivered to OSS

Procedure

1. Create a schema in DLA.
   1. Log on to the DLA console.
   2. Select the region where your OSS bucket is located from the drop-down list in the upper-left corner.
   3. In the left-side navigation pane, choose Data Lake Management > Data into the lake.
   4. On the Data into the lake page, click Go to The Wizard in the ActionTrail Log Cleaning section.
   5. In the ActionTrail Log Cleaning wizard, set the parameters as required.

      Parameter	Description
      ActionTrail File Root	The path of the OSS folder to which ActionTrail delivers events. The default path specified by DLA ends with AliyunLogs/Actiontrail. You can set this parameter in one of the following ways: Select Location: You specify a custom path to store events delivered by ActionTrail. Auto Discovery: DLA automatically specifies a default path to store events delivered by ActionTrail.
      Schema Name	The name of the mapped database of the OSS bucket in DLA.
      Data Storage Location After Cleaning	The path of the OSS folder where cleansed log data is stored. If you do no select the Custom check box, DLA automatically specifies a default path for storing cleansed log data. If you select the Custom check box, you can specify a custom path.
      Data Cleaning Time	The time when DLA starts to cleanse log data each day. The default value is 00:30. We recommend that you specify a time within the off-peak hours of your business to minimize the impact on your business.

   6. Click Create.
2. Synchronize events from the OSS bucket to DLA.
   1. In the next step of the ActionTrail Log Cleaning wizard, click Sync Now.
   2. Click Return metadata management. On the Metadata management page, find the created schema and click Library table details in the Actions column.
   3. On the Table tab of the Metadata management page, view the information about the synchronization.
      To modify the configuration of a schema, perform the following steps: On the Data into the lake page, find the target schema and click Edit in the Operation column. In the Configuration step, reset the parameters as required. For more information about schemas, see Schemas.
3. Use standard SQL statements to query and analyze events.
   1. In the left-side navigation pane, choose Serverless SQL > Execute.
   2. Find the target database that you want to analyze. If the database to be analyzed is not the current one, double click the target database.
   3. Enter the query statement in the SQL editor and click Sync Execute(F8). Then, DLA returns the execution result.
      

      Note You can use any valid SQL query statement to query events in DLA.

Examples

Query events for a user identified by a specific AccessKey ID

• Query statement: select * from `action_trail` where `user_identity_access_key_id` = 'target AccessKey ID' limit 20;
• Result: DLA returns the first 20 events that has occurred under the user identified by the target AccessKey ID.

Query events related to ECS for a user identified by a specific AccessKey ID

• Query statement: select * from `action_trail` where `user_identity_access_key_id` = 'target AccessKey ID' AND `service_name` = 'Ecs' limit 20;
• Result: DLA returns the first 20 events related to Elastic Compute Service (ECS) that has occurred under the user identified by the target AccessKey ID.

Schemas

The following table describes the key fields of a schema.