ActionTrail records the events that are related to Server Load Balancer (SLB) If an error occurs when you perform operations on SLB instances, you can query the details of the related event to obtain information such as the time when the event occurred, the region where the event occurred, and the SLB instance involved. This topic provides the logs of four sample SLB-related events and describes the key fields included in the event logs.

Delete an SLB instance by using an Alibaba Cloud account in the SLB console

The following sample event log indicates that an Alibaba Cloud account deleted the SLB instance whose ID is lb-bp1b3iffgeccmaww3**** from the China (Hangzhou) region in the SLB console at 20:21:55 on August 03, 2021, UTC+8.

{
  "eventId": "51D55867-8194-5C55-8F33-4385D7C37D99",
  "eventVersion": 1,
  "responseElements": {
    "RequestId": "51D55867-8194-5C55-8F33-4385D7C37D99"
  },
  "eventSource": "slb-pop.aliyuncs.com",
  "requestParameters": {
    "AcsHost": "slb-pop.aliyuncs.com",
    "AcsProduct": "Slb",
    "RequestId": "51D55867-8194-5C55-8F33-4385D7C37D99",
    "LoadBalancerId": "lb-bp1b3iffgeccmaww3****",
    "SlbApi__domiain": "slb-pop.aliyuncs.com",
    "https": "False",
    "HostId": "slb-pop.aliyuncs.com"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "ros.console.aliyun.com",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::SLB::LoadBalancer": [
      "lb-bp1b3iffgeccmaww3****"
    ]
  },
  "userIdentity": {
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-03T12:21:55Z"
      }
    },
    "accountId": "162728028114****",
    "principalId": "162728028114****",
    "type": "root-account",
    "userName": "root"
  },
  "serviceName": "Slb",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-15",
  "requestId": "51D55867-8194-5C55-8F33-4385D7C37D99",
  "eventTime": "2021-08-03T12:21:55Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DeleteLoadBalancer"
}

The sample event log contains the following key fields:

  • userIdentity.type: the identity type of the requester. The value in the example is root-account, which indicates an Alibaba Cloud account.
  • serviceName: the name of the Alibaba Cloud service related to the event. The value in the example is Slb, which indicates SLB.
  • eventName: the name of the event. The value in the example is DeleteLoadBalancer, which indicates that an SLB instance was deleted.
  • referencedResources: the one or more resources that are related to the event. The value in the example is {"ACS::SLB::LoadBalancer": ["lb-bp1b3iffgeccmaww3****"]}, which indicates the SLB instance whose ID is lb-bp1b3iffgeccmaww3****.
  • acsRegion: the region in which the event occurred. The value in the example is cn-hangzhou, which indicates the China (Hangzhou) region.
  • eventTime: the time when the event occurred in UTC. The value in the example is 2021-08-03T12:21:55Z, which indicates 20:21:55 on August 03, 2021, UTC+8.

Delete an SLB instance as a RAM user in the SLB console

The following sample event log indicates that the RAM user whose username is Alice deleted the SLB instance whose ID is lb-bp160ovcr2iicm8y4**** from the China (Hangzhou) region in the SLB console at 11:21:50 on August 05, 2021, UTC+8.

{
  "eventId": "458F7AFB-53D5-561E-979A-20B2FC1476CF",
  "eventVersion": 1,
  "responseElements": {
    "RequestId": "458F7AFB-53D5-561E-979A-20B2FC1476CF"
  },
  "eventSource": "slb-openapi-share.aliyuncs.com",
  "requestParameters": {
    "charset": "UTF-8",
    "AcsHost": "slb-openapi-share.aliyuncs.com",
    "AcsProduct": "Slb",
    "RequestId": "458F7AFB-53D5-561E-979A-20B2FC1476CF",
    "AcceptLanguage": "zh-CN",
    "LoadBalancerId": "lb-bp160ovcr2iicm8y4****",
    "RegionId": "cn-hangzhou",
    "HostId": "slb-openapi-share.aliyuncs.com"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "slb.console.aliyun.com",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::SLB::LoadBalancer": [
      "lb-bp160ovcr2iicm8y4****"
    ]
  },
  "userIdentity": {
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "true",
        "creationDate": "2021-08-05T03:21:50Z"
      }
    },
    "accountId": "173376625463****",
    "principalId": "20804860793058****",
    "type": "ram-user",
    "userName": "Alice"
  },
  "serviceName": "Slb",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-15",
  "requestId": "458F7AFB-53D5-561E-979A-20B2FC1476CF",
  "eventTime": "2021-08-05T03:21:50Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DeleteLoadBalancer"
}

The sample event log contains the following key fields:

  • userIdentity.type: the identity type of the requester. The value in the example is ram-user, which indicates a RAM user.
  • userIdentity.userName: the username of the RAM user.
  • serviceName: the name of the Alibaba Cloud service related to the event. The value in the example is Slb, which indicates SLB.
  • eventName: the name of the event. The value in the example is DeleteLoadBalancer, which indicates that an SLB instance was deleted.
  • referencedResources: the one or more resources that are related to the event. The value in the example is {"ACS::SLB::LoadBalancer": ["lb-bp160ovcr2iicm8y4****"]}, which indicates the SLB instance whose ID is lb-bp160ovcr2iicm8y4****.
  • acsRegion: the region in which the event occurred. The value in the example is cn-hangzhou, which indicates the China (Hangzhou) region.
  • eventTime: the time when the event occurred in UTC. The value in the example is 2021-08-05T03:21:50Z, which indicates 11:21:50 on August 05, 2021, UTC+8.

Delete an SLB instance by calling the DeleteLoadBalancer operation with an AccessKey pair used

The following sample event log indicates that an Alibaba Cloud account deleted the SLB instance whose ID is lb-bp19gskmju1h6tm3v**** from the China (Hangzhou) region by calling the DeleteLoadBalancer operation at 11:31:19 on August 05, 2021, UTC+8. The AccessKey pair whose ID is LTAI4GAhAbUyrykxM3mY**** is used to initiate the API call.

{
  "eventId": "89E7EA51-53A0-5C85-9D3C-3838F9CEA99D",
  "eventVersion": 1,
  "responseElements": {
    "RequestId": "89E7EA51-53A0-5C85-9D3C-3838F9CEA99D"
  },
  "eventSource": "slb.aliyuncs.com",
  "requestParameters": {
    "AcsHost": "slb.aliyuncs.com",
    "AcsProduct": "Slb",
    "RequestId": "89E7EA51-53A0-5C85-9D3C-3838F9CEA99D",
    "LoadBalancerId": "lb-bp19gskmju1h6tm3v****",
    "SignatureType": "",
    "RegionId": "cn-hangzhou",
    "HostId": "slb.aliyuncs.com"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "AlibabaCloud (linux; amd64) Golang/1.12.9 Core/0.0.1 HashiCorp-Terraform/0.12.1-1.55.4",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::SLB::LoadBalancer": [
      "lb-bp19gskmju1h6tm3v****"
    ]
  },
  "userIdentity": {
    "accessKeyId": "LTAI4GAhAbUyrykxM3mY****",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-05T03:31:19Z"
      }
    },
    "accountId": "152239434953****",
    "principalId": "152239434953****",
    "type": "root-account",
    "userName": "root"
  },
  "serviceName": "Slb",
  "additionalEventData": {
    "Scheme": "https",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-15",
  "requestId": "89E7EA51-53A0-5C85-9D3C-3838F9CEA99D",
  "eventTime": "2021-08-05T03:31:19Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DeleteLoadBalancer"
}

The sample event log contains the following key fields:

  • userIdentity.accessKeyId: the AccessKey ID that is used to initiate the API call. The value in the example is LTAI4GAhAbUyrykxM3mY****.
  • userIdentity.principalId: the ID of the account to which the AccessKey pair belongs. The value in the example is 152239434953****.
  • serviceName: the name of the Alibaba Cloud service related to the event. The value in the example is Slb, which indicates SLB.
  • eventName: the name of the event. The value in the example is DeleteLoadBalancer, which indicates that an SLB instance was deleted.
  • referencedResources: the one or more resources that are related to the event. The value in the example is {"ACS::SLB::LoadBalancer": ["lb-bp19gskmju1h6tm3v****"]}, which indicates the SLB instance whose ID is lb-bp19gskmju1h6tm3v****.
  • acsRegion: the region in which the event occurred. The value in the example is cn-hangzhou, which indicates the China (Hangzhou) region.
  • eventTime: the time when the event occurred in UTC. The value in the example is 2021-08-05T03:31:19Z, which indicates 11:31:19 on August 05, 2021, UTC+8.

Delete an SLB instance by assuming a RAM role

The following sample event log indicates that Container Service for Kubernetes (ACK) deleted the SLB instance whose ID is lb-bp1bqozygmlt8wohe**** from the China (Hangzhou) region by assuming the aliyuncsdefaultrole service-linked role at 09:10:13 on August 05, 2021, UTC+8.

{
  "eventId": "379F4611-D4C0-5DE7-A152-DDEA715A5E79",
  "eventVersion": 1,
  "responseElements": {
    "RequestId": "379F4611-D4C0-5DE7-A152-DDEA715A5E79"
  },
  "eventSource": "slb-pop.aliyuncs.com",
  "requestParameters": {
    "stsTokenPrincipalName": "aliyuncsdefaultrole/cs-provision-role-1628125309",
    "AcsHost": "slb-pop.aliyuncs.com",
    "AcsProduct": "Slb",
    "RequestId": "379F4611-D4C0-5DE7-A152-DDEA715A5E79",
    "LoadBalancerId": "lb-bp1bqozygmlt8wohe****",
    "SlbApi__domiain": "slb-pop.aliyuncs.com",
    "https": "False",
    "HostId": "slb-pop.aliyuncs.com",
    "stsTokenPlayerUid": 175434791765****
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "ros",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::SLB::LoadBalancer": [
      "lb-bp1bqozygmlt8wohe****"
    ]
  },
  "userIdentity": {
    "accessKeyId": "STS.9huAj27vmkaWKAoJytpctKRapi8sUSJerq7GFAAs9Lb9twgPzg****",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-05T01:10:13Z"
      }
    },
    "accountId": "190885984155****",
    "principalId": "33370898817881****:cs-provision-role-1628125309",
    "type": "assumed-role",
    "userName": "aliyuncsdefaultrole:cs-provision-role-1628125309"
  },
  "serviceName": "Slb",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-05-15",
  "requestId": "379F4611-D4C0-5DE7-A152-DDEA715A5E79",
  "eventTime": "2021-08-05T01:10:13Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DeleteLoadBalancer"
}

The sample event log contains the following key fields:

  • userIdentity.type: the identity type of the requester. The value in the example is assumed-role, which indicates a RAM role.
  • userIdentity.userName: the username of the requester. The value is in the format of {roleName}:{sessionName}. roleName indicates the name of the RAM role that was assumed. sessionName indicates the name that was specified when the actor assumed the RAM role. The value in the example is aliyuncsdefaultrole:cs-provision-role-1628125309, which indicates that the name of the RAM role that was assumed is aliyuncsdefaultrole, and the name that was specified when the actor assumed the RAM role is cs-provision-role-1628125309.
    Note By default, ACK assumes the aliyuncsdefaultrole role to access your resources in other Alibaba Cloud services.
  • requestParameters.stsTokenPlayerUid: the ID of the Alibaba Cloud account to which the actor belongs. The value in the example is 175434791765****.
  • referencedResources: the one or more resources that are related to the event. The value in the example is {"ACS::SLB::LoadBalancer": ["lb-bp1bqozygmlt8wohe****"]}, which indicates the SLB instance whose ID is lb-bp1bqozygmlt8wohe****.
  • serviceName: the name of the Alibaba Cloud service related to the event. The value in the example is Slb, which indicates SLB.
  • eventName: the name of the event. The value in the example is DeleteLoadBalancer, which indicates that an SLB instance was deleted.
  • acsRegion: the region in which the event occurred. The value in the example is cn-hangzhou, which indicates the China (Hangzhou) region.
  • eventTime: the time when the event occurred in UTC. The value in the example is 2021-08-05T01:10:13Z, which indicates 09:10:13 on August 05, 2021, UTC+8.