Use DLA to query and analyze events delivered to OSS

Procedure

1. Create a schema in DLA.
   1. Log on to the DLA console.
   2. Select the region where your OSS bucket resides from the drop-down list in the upper-left corner.
   3. In the left-side navigation pane, choose Data Lake Management > Data into the lake.
   4. On the Data into the lake page, click Go to The Wizard in the ActionTrail Log Cleaning section.
   5. In the ActionTrail Log Cleaning wizard, set the parameters as required.

      Parameter	Description
      ActionTrail File Root	The storage path where the logs of events that ActionTrail delivers to OSS are saved. The path must end with AliyunLogs/Actiontrail. You can set this parameter in one of the following ways: Select Location: You specify a custom path to store the logs of events delivered by ActionTrail. Auto Discovery: DLA automatically specifies a default path to store the logs of events delivered by ActionTrail.
      Schema Name	The name of the schema. This parameter specifies the name of the DLA database that is mapped to the OSS bucket.
      Data Storage Location After Cleaning	The path of the OSS folder to which the cleansed log data is written. If you do no select Custom, DLA automatically specifies a default path for storing the cleansed log data. If you select Custom, you can specify a custom path.
      Data Cleaning Time	The time at which DLA cleanses OSS log data every day. By default, data cleansing is enabled at 00:30. To prevent your business from being affected during data cleansing, we recommend that you set this parameter to a time within off-peak hours based on your business requirements.

   6. Click Create.
2. Synchronize events from the OSS bucket to DLA.
   1. In the next step of the ActionTrail Log Cleaning wizard, click Sync Now.
   2. Click Return metadata management. On the Metadata management page, find the created schema in the schema list and click Library table details in the Actions column.
   3. On the Table tab of the Metadata management page, view the information about the synchronization.
      For more information about schemas, see Schemas.
3. Use standard SQL statements to query and analyze events.
   1. In the left-side navigation pane, choose Serverless Presto > Execute.
   2. Find the database based on which you want to analyze events and double-click the database name.
   3. Enter the query statement in the SQL editor and click Sync Execute(F8). Then, DLA returns the execution result.

Examples

Query events for a user identified by a specific AccessKey ID

• Query statement: select * from `action_trail` where `user_identity_access_key_id` = 'User AccessKey ID' limit 20;
• Results: DLA returns the first 20 events that occurred within the user account identified by the specified AccessKey ID.

Query ECS-related events for a user identified by a specific AccessKey ID

• Query statement: select * from `action_trail` where `user_identity_access_key_id` = 'User AccessKey ID' AND `service_name` = 'Ecs' limit 20;
• Results: DLA returns the first 20 events related to Elastic Compute Service (ECS) that occurred within the user account identified by the specified AccessKey ID.

Schemas

The following table describes the key fields of a schema.