Create a trail and deliver events to Simple Log Service with Python SDK - ActionTrail

ActionTrail retains events for each Alibaba Cloud account for only 90 days by default. To store events longer for security analysis, compliance auditing, or troubleshooting, create a trail to deliver new events to Simple Log Service (SLS), Object Storage Service (OSS), or MaxCompute. The following walkthrough uses PyCharm and the Python SDK to create a single-account trail that delivers events to Simple Log Service.

Prerequisites

You have activated Simple Log Service. For more information, see Activate Simple Log Service.

Important
Activating Simple Log Service is free of charge. However, you are charged for storing events after ActionTrail delivers them to Simple Log Service. For more information about billing, see Billing overview.
You have installed Python and set up a Python development environment, such as PyCharm. For more information, see Install Python and Set up a Python development environment on Windows.
You have obtained an AccessKey pair for your Alibaba Cloud account and configured environment variables. For more information, see Create an AccessKey pair and Configure an Alibaba Cloud AccessKey in the environment variables of a Windows system.

Background

To create a single-account trail with the Python SDK, first create a Project in Simple Log Service, and then create the trail in ActionTrail. New trails are Disabled by default. Enable the trail before you query and analyze events in Simple Log Service.

Step 1: Create a Project in Simple Log Service

The following example creates a Project named cloud-trail-project-test in the China (Hangzhou) region.

In PyCharm, create a project. For example, actiontrail.

A file named main.py is generated. You will use this file to run the Python SDK code.
In PyCharm, click Terminal or press Alt + F12 to open the Terminal.
Run the following command to install the SDK dependency.

pip install alibabacloud_sls20201230

In the main.py file, run the following code to create a Project named cloud-trail-project-test in the China (Hangzhou) region.

Update the following parameters in the code as needed:

config.endpoint = f'cn-hangzhou.log.aliyuncs.com': hangzhou specifies the region of the Project. You can change the region as needed. For information about the regions that Simple Log Service supports, see Endpoints.
project_name='cloud-trail-project-test': cloud-trail-project-test is the Project name. You can change the name as needed. For naming conventions, see the projectName request parameter in CreateProject.

import os
import sys
from typing import List
from alibabacloud_sls20201230.client import Client as Sls20201230Client
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_sls20201230 import models as sls_20201230_models
from alibabacloud_tea_util import models as util_models
class Sample:
    def __init__(self):
        pass
    @staticmethod
    def create_client() -> Sls20201230Client:       
        config = open_api_models.Config(
            access_key_id=os.environ['ALIBABA_CLOUD_ACCESS_KEY_ID'],
            access_key_secret=os.environ['ALIBABA_CLOUD_ACCESS_KEY_SECRET']
        )
        config.endpoint = f'cn-hangzhou.log.aliyuncs.com'
        return Sls20201230Client(config)
    @staticmethod
    def main(args: List[str],) -> None:
        client = Sample.create_client()
        create_project_request = sls_20201230_models.CreateProjectRequest(
            project_name='cloud-trail-project-test'
        )
        runtime = util_models.RuntimeOptions()
        headers = {}
        try:
            client.create_project_with_options(create_project_request, headers, runtime)
        except Exception as error:
            print(error.message)
if __name__ == '__main__':
    Sample.main(sys.argv[1:])

Verify that the cloud-trail-project-test Project was created.

Log on to the Simple Log Service console. In the Projects section, view the newly created Project.

Step 2: Create and enable a trail in ActionTrail

The following example creates a trail named cloud_trail_test in the China (Hangzhou) region.

In PyCharm, click Terminal at the bottom of the window or press Alt + F12 to open the Terminal.
Run the following command to install the SDK dependency.

pip install alibabacloud_actiontrail20200706

In the main.py file, run the following code to create a trail named cloud_trail_test.

Update the following parameters in the code as needed:

name='cloud_trail_test': cloud_trail_test is the trail name. You can change the name as needed. For naming conventions, see the Name parameter in CreateTrail.
sls_project_arn='acs:log:cn-hangzhou:141339776561****:project/cloud-trail-project-test': acs:log:cn-hangzhou:141339776561****:project/cloud-trail-project-test is the Alibaba Cloud Resource Name (ARN) of the destination Project for event delivery. In the ARN, 141339776561**** is your account ID, and cloud-trail-project-test and cn-hangzhou are the name and region of the Project that you created in Step 1. Modify these values as needed.

import os
import sys
from typing import List
from alibabacloud_actiontrail20200706.client import Client as Actiontrail20200706Client
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_actiontrail20200706 import models as actiontrail_20200706_models
from alibabacloud_tea_util import models as util_models
class Sample:
    def __init__(self):
        pass
    @staticmethod
    def create_client() -> Actiontrail20200706Client:
        config = open_api_models.Config(
            access_key_id=os.environ['ALIBABA_CLOUD_ACCESS_KEY_ID'],
            access_key_secret=os.environ['ALIBABA_CLOUD_ACCESS_KEY_SECRET']
        )
        config.endpoint = f'actiontrail.cn-hangzhou.aliyuncs.com'
        return Actiontrail20200706Client(config)
    @staticmethod
    def main(args: List[str], ) -> None:
        client = Sample.create_client()
        create_trail_request = actiontrail_20200706_models.CreateTrailRequest(
            name='cloud_trail_test',
            sls_project_arn='acs:log:cn-hangzhou:141339776561****:project/cloud-trail-project-test'
        )
        runtime = util_models.RuntimeOptions()
        try:
            client.create_trail_with_options(create_trail_request, runtime)
        except Exception as error:
            print(error.message)
if __name__ == '__main__':
    Sample.main(sys.argv[1:])

In the main.py file, run the following code to enable the trail named cloud_trail_test.

name='cloud_trail_test' is the name of the trail created in the previous step. Modify the name as needed.

import os
import sys
from typing import List
from alibabacloud_actiontrail20200706.client import Client as Actiontrail20200706Client
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_actiontrail20200706 import models as actiontrail_20200706_models
from alibabacloud_tea_util import models as util_models
class Sample:
    def __init__(self):
        pass
    @staticmethod
    def create_client() -> Actiontrail20200706Client:
        config = open_api_models.Config(
            access_key_id=os.environ['ALIBABA_CLOUD_ACCESS_KEY_ID'],
            access_key_secret=os.environ['ALIBABA_CLOUD_ACCESS_KEY_SECRET']
        )
        config.endpoint = f'actiontrail.cn-hangzhou.aliyuncs.com'
        return Actiontrail20200706Client(config)
    @staticmethod
    def main(args: List[str],) -> None:
        client = Sample.create_client()
        start_logging_request = actiontrail_20200706_models.StartLoggingRequest(
            name='cloud_trail_test'
        )
        runtime = util_models.RuntimeOptions()
        try:
            client.start_logging_with_options(start_logging_request, runtime)
        except Exception as error:
            print(error.message)
if __name__ == '__main__':
    Sample.main(sys.argv[1:])

Verify that the cloud_trail_test trail was created and that its Status is Enabled.
1. Log on to the ActionTrail console.
2. In the left-side navigation pane, click Trails.
  
  On the Trails page, view the newly created trail and its status.

Step 3: View events in Simple Log Service

View, query, and analyze the events delivered from ActionTrail in the Simple Log Service console.

Log on to the Simple Log Service console.
In the Projects section, click the cloud-trail-project-test Project.

In the actiontrail_cloud_trail_test Logstore, view the events delivered by the cloud_trail_test trail.

Note
When you create a trail, ActionTrail automatically creates a Logstore named actiontrail_cloud_trail_test in the destination Project (the Project created in Step 1).

On the Raw Logs tab, you can view the detailed fields for an event, including acsRegion (region), eventName (event name), eventSource (event source), eventType (event type), serviceName (service name), and eventRw (read/write type).

References

For more information about how to query and analyze events in Simple Log Service, see Quick start for log query and analysis.
For common event analysis scenarios, see Analyze events in Simple Log Service.
To create a trail by using the ActionTrail console, see Create a single-account trail.