ApsaraDB RDS - ActionTrail - Alibaba Cloud Documentation Center

ActionTrail records the events that are related to ApsaraDB RDS. You can query the details of an ApsaraDB RDS-related event to obtain information such as the time when the event occurred, the region where the event occurred, and the ApsaraDB RDS instance involved. This topic provides the logs of sample events that are related to ApsaraDB RDS and describes the key fields included in the event logs.

Restart an RDS instance by using an Alibaba Cloud account in the console

In the following example, an Alibaba Cloud account restarted the RDS instance whose ID is rm-bp18vn5itslhw**** in the China (Hangzhou) region in the ApsaraDB RDS console at 15:34:58 on August 4, 2021 (UTC+8).

{
  "eventId": "4EC856C0-A735-52D0-A7E6-E5CD09A5BCD4",
  "eventVersion": 1,
  "responseElements": {
    "RequestId": "4EC856C0-A735-52D0-A7E6-E5CD09A5BCD4"
  },
  "eventSource": "rds-inc-share.aliyuncs.com",
  "requestParameters": {
    "charset": "UTF-8",
    "AcsHost": "rds-inc-share.aliyuncs.com",
    "AcsProduct": "Rds",
    "RequestId": "4EC856C0-A735-52D0-A7E6-E5CD09A5BCD4",
    "DBInstanceId": "rm-bp18vn5itslhw****",
    "AcceptLanguage": "zh-CN",
    "HostId": "rds-inc-share.aliyuncs.com"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "rdsnext.console.aliyun.com",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::RDS::DBInstance": [
      "rm-bp18vn5itslhw****"
    ]
  },
  "userIdentity": {
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-04T07:34:58Z"
      }
    },
    "accountId": "147395807376****",
    "principalId": "147395807376****",
    "type": "root-account",
    "userName": "root"
  },
  "serviceName": "Rds",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-08-15",
  "requestId": "4EC856C0-A735-52D0-A7E6-E5CD09A5BCD4",
  "eventTime": "2021-08-04T07:34:58Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "RestartDBInstance"
}

The preceding example contains the following key fields:

userIdentity.type: the identity type of the requester. The value in this example is root-account, which indicates an Alibaba Cloud account.
serviceName: the name of the Alibaba Cloud service related to the event. The value in this example is Rds, which indicates ApsaraDB RDS.
eventName: the name of the event. The value in this example is RestartDBInstance, which indicates that an RDS instance was restarted.
referencedResources: the resources that are related to the event. The value in this example is {"ACS::RDS::DBInstance": ["rm-bp18vn5itslhw****"}, which indicates the RDS instance with an ID of rm-bp18vn5itslhw****.
acsRegion: the region in which the event occurred. The value in this example is cn-hangzhou, which indicates that the event occurred in the China (Hangzhou) region.
eventTime: the time when the event occurred in UTC. The value in this example is 2021-08-04T07:34:58Z, which indicates that the event occurred at 15:34:58 on August 4, 2021 (UTC+8).

Restart an RDS instance as a RAM user in the console

In the following example, the RAM user whose username is Alice restarted the RDS instance whose ID is rm-bp15hkr5tb57v**** in the China (Hangzhou) region at 10:54:38 on August 4, 2021 (UTC+8). The RAM user restarted the RDS instance in the ApsaraDB RDS console.

{
  "apiVersion": "2014-08-15",
  "requestId": "532F2CED-F931-57FC-B08E-5AF8FF443DD5",
  "eventType": "ApiCall",
  "userIdentity": {
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-04T02:54:38Z"
      }
    },
    "accountId": "183080612160****",
    "principalId": "20816241517167****",
    "type": "ram-user",
    "userName": "Alice"
  },
  "acsRegion": "cn-hangzhou",
  "eventName": "RestartDBInstance",
  "requestParameters": {
    "charset": "UTF-8",
    "AcsHost": "rds-inc-share.aliyuncs.com",
    "AcsProduct": "Rds",
    "RequestId": "532F2CED-F931-57FC-B08E-5AF8FF443DD5",
    "DBInstanceId": "rm-bp15hkr5tb57v****",
    "AcceptLanguage": "zh-CN",
    "HostId": "rds-inc-share.aliyuncs.com"
  },
  "eventSource": "rds-inc-share.aliyuncs.com",
  "serviceName": "Rds",
  "eventTime": "2021-08-04T02:54:38Z",
  "referencedResources": {
    "DBInstance": [
      "rm-bp15hkr5tb57v****"
    ],
    "ACS::RDS::DBInstance": [
      "rm-bp15hkr5tb57v****"
    ]
  },
  "userAgent": "rdsnext.console.aliyun.com",
  "eventId": "532F2CED-F931-57FC-B08E-5AF8FF443DD5",
  "additionalEventData": {
    "Scheme": "http"
  },
  "responseElements": {
    "RequestId": "532F2CED-F931-57FC-B08E-5AF8FF443DD5"
  },
  "errorCode": "",
  "errorMessage": "",
  "eventVersion": "1",
  "sourceIpAddress": "192.168.XX.XX"
}

The preceding example contains the following key fields:

userIdentity.type: the identity type of the requester. The value in this example is ram-user, which indicates a RAM user.
userIdentity.userName: the username of the RAM user.
serviceName: the name of the Alibaba Cloud service related to the event. The value in this example is Rds, which indicates ApsaraDB RDS.
eventName: the name of the event. The value in this example is RestartDBInstance, which indicates that an RDS instance was restarted.
referencedResources: the resources that are related to the event. The value in this example is {"DBInstance": ["rm-bp15hkr5tb57v****"],"ACS::RDS::DBInstance": ["rm-bp15hkr5tb57v****"]}, which indicates the RDS instance with an ID of rm-bp15hkr5tb57v****.
acsRegion: the region in which the event occurred. The value in this example is cn-hangzhou, which indicates that the event occurred in the China (Hangzhou) region.
eventTime: the time when the event occurred in UTC. The value is 2021-08-04T02:54:38Z, which indicates that the event occurred at 10:54:38 on August 4, 2021 (UTC+8).

Restart an RDS instance by calling the RestartDBInstance operation with an AccessKey pair used

In the following example, an Alibaba Cloud account restarted the RDS instance whose ID is rm-1udt95gm98274**** in the China (Shanghai) region by calling the RestartDBInstance operation at 10:29:37, August 4, 2021 (UTC+8). The Alibaba Cloud account used the AcccessKey pair whose AcccessKey ID is LTAI**************** to initiate the API call.

{
  "eventId": "55149DB3-9B17-5F96-99D7-10BCEC5A669D",
  "eventVersion": 1,
  "responseElements": {
    "RequestId": "55149DB3-9B17-5F96-99D7-10BCEC5A669D"
  },
  "eventSource": "rds.aliyuncs.com",
  "requestParameters": {
    "AcsHost": "rds.aliyuncs.com",
    "AcsProduct": "Rds",
    "RequestId": "55149DB3-9B17-5F96-99D7-10BCEC5A669D",
    "DBInstanceId": "rm-1udt95gm98274****",
    "HostId": "rds.aliyuncs.com",
    "ClientToken": "4d31085d-8403-4f43-a600-41294335****"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "Apache-HttpClient/4.5.2 (Java/1.8.0_191)",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::RDS::DBInstance": [
      "rm-1udt95gm98274****"
    ]
  },
  "userIdentity": {
    "accessKeyId": "LTAI****************",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-04T02:29:37Z"
      }
    },
    "accountId": "514024858446****",
    "principalId": "514024858446****",
    "type": "root-account",
    "userName": "root"
  },
  "serviceName": "Rds",
  "additionalEventData": {
    "Scheme": "https",
    "CallerBid": "26888"
  },
  "apiVersion": "2014-08-15",
  "requestId": "55149DB3-9B17-5F96-99D7-10BCEC5A669D",
  "eventTime": "2021-08-04T02:29:37Z",
  "isGlobal": false,
  "acsRegion": "cn-shanghai",
  "eventName": "RestartDBInstance"
}

The preceding example contains the following key fields:

userIdentity.accessKeyId: the AccessKey ID that is used to initiate the API call. The value in this example is LTAI****************.
userIdentity.principalId: the ID of the account to which the AccessKey pair belongs. The value in this example is 514024858446****.
userIdentity.type: the identity type of the requester. The value in this example is root-account, which indicates an Alibaba Cloud account.
serviceName: the name of the Alibaba Cloud service related to the event. The value in this example is Rds, which indicates ApsaraDB RDS.
eventName: the name of the event. The value in this example is RestartDBInstance, which indicates that an RDS instance was restarted.
referencedResources: the resources that are related to the event. The value in this example is {"ACS::RDS::DBInstance": ["rm-1udt95gm98274****"]}, which indicates the RDS instance with an ID of rm-1udt95gm98274****.
acsRegion: the region in which the event occurred. The value in this example is cn-shanghai, which indicates that the event occurred in the China (Shanghai) region.
eventTime: the time when the event occurred in UTC. The value in this example is 2021-08-04T02:29:37Z, which indicates that the event occurred at 10:29:37 on August 4, 2021 (UTC+8).

Restart an RDS instance by assuming a RAM role as a RAM user

In the following example, a RAM user of the Alibaba Cloud account whose ID is 165367888785**** restarted the RDS instance whose ID is rm-bp1cw83fsi6j3**** in the China (Hangzhou) region at 14:15:46 on August 2, 2021 (UTC+8). The RAM user restarted the RDS instance by assuming the aliyunid-ag-ram-role-admin RAM role that belongs to the Alibaba Cloud account with an ID of 109052579984****.

{
  "eventId": "191D3EE5-82C7-48BC-B128-37A0BE30FF38",
  "eventVersion": 1,
  "responseElements": {
    "RequestId": "191D3EE5-82C7-48BC-B128-37A0BE30FF38"
  },
  "eventSource": "rds-inc-share.aliyuncs.com",
  "requestParameters": {
    "stsTokenPrincipalName": "aliyunid-ag-ram-role-admin/default",
    "charset": "UTF-8",
    "AcsHost": "rds-inc-share.aliyuncs.com",
    "AcsProduct": "Rds",
    "RequestId": "191D3EE5-82C7-48BC-B128-37A0BE30FF38",
    "DBInstanceId": "rm-bp1cw83fsi6j3****",
    "AcceptLanguage": "zh-CN",
    "HostId": "rds-inc-share.aliyuncs.com",
    "stsTokenPlayerUid": 165367888785****
  },
  "sourceIpAddress": "Internal",
  "userAgent": "rdsnext.console.aliyun.com",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::RDS::DBInstance": [
      "rm-bp1cw83fsi6j3****"
    ]
  },
  "userIdentity": {
    "accessKeyId": "STS.****************",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-02T06:15:46Z"
      }
    },
    "accountId": "109052579984****",
    "principalId": "36661865364550****:default",
    "type": "assumed-role",
    "userName": "aliyunid-ag-ram-role-admin:default"
  },
  "serviceName": "Rds",
  "additionalEventData": {
    "Scheme": "http",
    "CallerBid": "26842"
  },
  "apiVersion": "2014-08-15",
  "requestId": "191D3EE5-82C7-48BC-B128-37A0BE30FF38",
  "eventTime": "2021-08-02T06:15:46Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "RestartDBInstance"
}

The preceding example contains the following key fields:

userIdentity.type: the identity type of the requester. The value in this example is assumed-role, which indicates a RAM role.
userIdentity.userName: the username of the requester. The value is in the format of {roleName}:{sessionName}. roleName indicates the name of the RAM role that was assumed. sessionName indicates the name that was specified when the RAM user assumed the role. The value in this example is aliyunid-ag-ram-role-admin:default. aliyunid-ag-ram-role-admin indicates the name of the RAM role that was assumed. default indicates the name that was specified when the RAM user assumed the RAM role.
requestParameters.stsTokenPlayerUid: the ID of the Alibaba Cloud account to which the RAM user belongs. The value in this example is 165367888785****.
referencedResources: the resources that are related to the event. The value in this example is {"ACS::RDS::DBInstance": ["rm-bp1cw83fsi6j3****"]}, which indicates the RDS instance with an ID of rm-bp1cw83fsi6j3****.
serviceName: the name of the Alibaba Cloud service related to the event. The value in this example is Rds, which indicates ApsaraDB RDS.
eventName: the name of the event. The value in this example is RestartDBInstance, which indicates that an RDS instance was restarted.
acsRegion: the region in which the event occurred. The value in this example is cn-hangzhou, which indicates that the event occurred in the China (Hangzhou) region.
eventTime: the time when the event occurred in UTC. The value in this example is 2021-08-02T06:15:46Z, which indicates that the event occurred at 14:15:46 on August 2, 2021 (UTC+8).