ActionTrail:Use SDKs to create a trail

Step 1: Configure Log Service

Before you create a trail, you must create a Log Service project and a Logstore whose name is in the actiontrail_{TrailName} format. TrailName specifies the name of the trail that you want to create.

If you want to analyze event logs, you must configure indexes for the Logstore and create a dashboard. You can use Log Service SDK for Python to configure Log Service. For more information about the SDK, visit aliyun-log-python-sdk.

1. Create a Python file in Visual Studio Code.

2. Install dependencies and initialize the SDK.

   1. Install dependencies.

      $ pip install -U aliyun-log-python-sdk

   2. Initialize Log Service SDK for Python.

      from aliyun.log import LogClient
      from alibabacloud_credentials.client import Client as CredClient
      
      # The China (Hangzhou) region. 
      region = 'cn-hangzhou'
      
      # The Log Service endpoint.
      endpoint = '{region}.log.aliyuncs.com'.format(region=region)
      # Use the default credential to initialize the Credentials client.
      cred = CredClient()
      # The AccessKey ID that is managed in Credentials.
      access_key_id = cred.get_access_key_id()
      # The AccessKey secret that is managed in Credentials.
      access_key_secret = cred.get_access_key_secret()
      # The ID of the Alibaba Cloud account.
      account_id = '123456789'
      
      client = LogClient(endpoint, access_key_id, access_key_secret)

      Note

      Specify the region and the Alibaba Cloud account ID based on your business requirements.

3. Create a Log Service project and a Logstore.

   # The name of the trail.
   trail_name = 'cloud_trail'
   
   # The name of the Log Service project.
   log_project_name = 'cloud-trail-project'
   
   # Create a Log Service project.
   res = client.create_project(log_project_name, 'The Log Service project to which the events of ActionTrail are delivered')
   res.log_print()
   
   # The name of the Logstore.
   log_store_name = 'actiontrail_{trail_name}'.format(trail_name=trail_name)
   # Create a Logstore.
   res = client.create_logstore(log_project_name, log_store_name, shard_count=3, preserve_storage=True)
   res.log_print()

   Note

   Specify the names of the trail, Log Service project, and Logstore based on your business requirements. When you create the Logstore, set preserve_storage to True. This specifies that events are permanently stored in the Logstore.

4. Configure indexes.

   1. Create an index configuration file named log_index.json.

      Visit the open source code repository and download the index configuration file.

   2. Create indexes.

      import json
      from aliyun.log import LogClient
      from aliyun.log import IndexConfig
      
      def get_json_data(path):
          with open(path,encoding='utf-8') as f:
              return json.load(f)
            
      # Read the index configurations from the log_index.json file.
      index_json = get_json_data('./log_index.json')
      index_detail = IndexConfig()
      index_detail.from_json(index_json)
      # Create indexes.
      client.create_index(log_project_name, log_store_name, index_detail)

5. Create a dashboard.

   1. Create a dashboard configuration file named log_dashboard.json.

      Visit the open source code repository and download the dashboard configuration file.

   2. Create a dashboard.

      # Read the dashboard configurations from the log_dashboard.json file.
      dashboard_detail = get_json_data('./log_dashboard.json')
      # Create a dashboard. 
      client.create_dashboard(log_project_name, dashboard_detail)

Step 2: Create and enable a trail

You can use ActionTrail SDK for Python to create a trail. For more information about the SDK, visit aliyun-python-sdk-core.

1. Initialize ActionTrail SDK for Python.

   1. Install dependencies.

      $ pip install aliyun-python-sdk-core
      $ pip install aliyun-python-sdk-actiontrail

   2. Initialize ActionTrail SDK for Python.

      from aliyunsdkcore.client import AcsClient
      from aliyunsdkcore.acs_exception.exceptions import ClientException
      from aliyunsdkcore.acs_exception.exceptions import ServerException
      from aliyunsdkactiontrail.request.v20200706.CreateTrailRequest import CreateTrailRequest
      
      client = AcsClient(access_key_id, access_key_secret, region)

2. Create a trail to deliver events to the Log Service project that you created.

   Use ActionTrail SDK for Python to call the CreateTrail operation to create a trail. For more information, see CreateTrail.

   sls_project_arn = 'acs:log:{region}:{account_id}:project/{log_project_name}'.format(
       region=region,
       account_id=account_id,
       log_project_name=log_project_name,
   )
   
   request = CreateTrailRequest()
   request.set_accept_format('json')
   
   # Specify a trail name.
   request.set_Name(trail_name)
   # Specify the Alibaba Cloud Resource Name (ARN) of the Log Service project.
   request.set_SlsProjectArn(sls_project_arn)
   # Track all events.
   request.set_EventRW("All")
   # Track the events in all regions.
   request.set_TrailRegion("All")
   
   response = client.do_action_with_exception(request)
   print(str(response, encoding='utf-8'))

   Note

   After you create a trail, the trail enters the Fresh state. This indicates that the trail is created but is not enabled. You must manually enable the trail.

3. Enable the trail.

   Use ActionTrail SDK for Python to call the StartLogging operation to enable the trail. For more information, see StartLogging.

   from aliyunsdkactiontrail.request.v20200706.StartLoggingRequest import StartLoggingRequest
   
   request = StartLoggingRequest()
   request.set_accept_format('json')
   
   request.set_Name(trail_name)
   
   response = client.do_action_with_exception(request)
   print(str(response, encoding='utf-8'))

   Note

   You can visit the open source code repository to view the complete sample code.