Queries the operation logs of regular users.

Description

You can audit operation logs of regular users to improve security. The operation logs include events such as desktop startup, shutdown, and session closure.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

Request parameters

Parameter Type Required Example Description
Action String Yes DescribeClientEvents

The operation that you want to perform. Set the value to DescribeClientEvents.

RegionId String Yes cn-hangzhou

The ID of the region.

EndUserId String No 28961708130834****

The RAM user ID or Active Directory (AD) username. If you do not specify a value for this parameter, events of all users in the specified region are queried.

DesktopId String No ecd-8fupvkhg0aayu****

The ID of the cloud desktop. If you do not specify a value for this parameter, events of all cloud desktops in the specified region are queried.

DesktopIp String No 10.10.*.*

The IP address of the cloud desktop. If you do not specify a value for this parameter, events of all cloud desktops in the specified region are queried.

OfficeSiteId String No cn-hangzhou+dir-bh77qa8nmjot4****

The ID of the workspace to which the cloud desktop belongs. If you do not specify a value for this parameter, events of all workspaces in the specified region are queried.

EventType String No DESKTOP_DISCONNECT

The type of the event to be queried. Valid values:

  • DESKTOP_CONNECT: The desktop session is established.
  • DESKTOP_DISCONNECT: The desktop session is closed.
  • DESKTOP_REBOOT: The cloud desktop is restarted.
  • CLIENT_AD_LOGIN: The AD user is logged on.
  • GET_CONNECTION_TICKET: The request to connect to the cloud desktop is sent from the client.
  • DESKTOP_START: The cloud desktop is started.
  • DESKTOP_STOP: The cloud desktop is stopped.

If you do not specify a value for this parameter, events of all types are queried.

StartTime String No 2020-11-30T06:32:31Z

The beginning of the time range to query. Specify the time in the ISO 8601 standard in the yyyy-MM-ddTHH:mm:ssZ format. The time must be in UTC.

If you do not specify a value for this parameter, all events that occurred before the point in time specified by EndTime are queried.

EndTime String No 2020-11-31T06:32:31Z

The end of the time range to query. Specify the time in the ISO 8601 standard in the yyyy-MM-ddTHH:mm:ssZ format. The time must be in UTC.

If you do not specify a value for this parameter, the current time is used.

MaxResults Integer No 10

The number of entries to be returned on each page.

Default value: 100.

NextToken String No AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****

The query token. Set the value to the NextToken value returned in the last call to the DescribeClientEvents operation.

Response parameters

Parameter Type Example Description
Events Array of Event

Details about the events.

AliUid String 112259558861****

The ID of the associated Alibaba Cloud account.

BytesReceived String 8665

The number of bytes received.

BytesSend String 2345

The number of bytes sent.

ClientIp String 100.68.*.*

The IP address of the client.

ClientOS String Darwin 17.7.0 x64

The operating system of the client.

ClientVersion String 1.0.4 202012021700

The version of the client.

DesktopId String ecd-8fupvkhg0aayu****

The ID of the cloud desktop.

DesktopIp String 10.10.*.*

The IP address of the cloud desktop.

DirectoryId String cn-hangzhou+dir-bh77qa8nmjot4****

The ID of the directory to which the cloud desktop belongs.

DirectoryType String RAM

The type of the directory.

EndUserId String 28961708130834****

The RAM user ID or AD username.

EventId String 5651188b-3070-d1cc-5311-75753d59****

The ID of the event.

EventTime String 2020-11-30T06:32:31Z

The time when the event occurred.

EventType String DESKTOP_DISCONNECT

The type of the event.

OfficeSiteId String cn-hangzhou+dir-bh77qa8nmjot4****

The ID of the workspace to which the cloud desktop belongs.

OfficeSiteType String SIMPLE

The account type of the workspace. The valid values include:

  • SIMPLE: convenience account.
  • AD_CONNECTOR: enterprise AD account.
RegionId String cn-hangzhou

The ID of the region.

Status String 200

The status of the event behavior.

NextToken String AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****

The query token that is returned in this call.

RequestId String 28A40F12-F340-442B-A35F-46EF6A03227B

The ID of the request.

Examples

Sample requests

https://ecd.cn-hangzhou.aliyuncs.com/?Action=DescribeClientEvents
&RegionId=cn-hangzhou
&<Common request parameters>

Successful sample responses

XML format

<DescribeClientEventsResponse>
  <RequestId>28A40F12-F340-442B-A35F-46EF6A03227B</RequestId>
  <NextToken>AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****</NextToken>
  <Events>
        <Status>200</Status>
        <EventType>DESKTOP_DISCONNECT</EventType>
        <OfficeSiteType>SIMPLE</OfficeSiteType>
        <DesktopId>ecd-8fupvkhg0aayu****</DesktopId>
        <BytesSend>2345</BytesSend>
        <ClientVersion>1.0.4 202012021700</ClientVersion>
        <ClientIp>100.68.*.*</ClientIp>
        <DirectoryType>RAM</DirectoryType>
        <ClientOS>Darwin 17.7.0 x64</ClientOS>
        <OfficeSiteId>cn-hangzhou+dir-bh77qa8nmjot4****</OfficeSiteId>
        <BytesReceived>8665</BytesReceived>
        <DirectoryId>cn-hangzhou+dir-bh77qa8nmjot4****</DirectoryId>
        <EndUserId>28961708130834****</EndUserId>
        <EventTime>2020-11-30T06:32:31Z</EventTime>
        <EventId>5651188b-3070-d1cc-5311-75753d59****</EventId>
        <RegionId>cn-hangzhou</RegionId>
        <DesktopIp>10.10.*.*</DesktopIp>
        <AliUid>112259558861****</AliUid>
  </Events>
</DescribeClientEventsResponse>

JSON format

{
    "DescribeClientEventsResponse": {
        "RequestId": "28A40F12-F340-442B-A35F-46EF6A03227B",
        "NextToken": "AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****",
        "Events": {
            "Status": 200,
            "EventType": "DESKTOP_DISCONNECT",
            "OfficeSiteType": "SIMPLE",
            "DesktopId": "ecd-8fupvkhg0aayu****",
            "BytesSend": 2345,
            "ClientVersion": "1.0.4 202012021700",
            "ClientIp": "100.68.*.*",
            "DirectoryType": "RAM",
            "ClientOS": "Darwin 17.7.0 x64",
            "OfficeSiteId": "cn-hangzhou+dir-bh77qa8nmjot4****",
            "BytesReceived": 8665,
            "DirectoryId": "cn-hangzhou+dir-bh77qa8nmjot4****",
            "EndUserId": "28961708130834****",
            "EventTime": "2020-11-30T06:32:31Z",
            "EventId": "5651188b-3070-d1cc-5311-75753d59****",
            "RegionId": "cn-hangzhou",
            "DesktopIp": "10.10.*.*",
            "AliUid": "112259558861****"
        }
    }
}