Bastionhost supports archiving audit logs to Simple Log Service (SLS). Audit logs are records of user operations on Bastionhost, including session command audits and operation logs. Once you configure audit log archiving, Bastionhost automatically forwards new audit logs to SLS in real time. This topic describes how to archive audit logs to SLS.
Only audit logs generated after the configuration is complete can be archived to SLS.
Background
By default, Bastionhost stores logs for 180 days. If you need long-term retention, you can archive audit logs to SLS. Both session command audits and operation logs are supported for archiving. After archiving audit logs to SLS, you can query and analyze the logs, customize the log retention period, and forward them from SLS to third-party platforms such as Splunk. For more information, see Query and analysis or SLS Splunk Add-on.
Archiving audit logs to SLS does not affect the audit logs in Bastionhost. You can still view the audit logs on the Session Audit page. For more information, see Search and View Sessions.
Procedure
Log on to the SLS console.
Follow the on-screen instructions to activate SLS.
Go to the Log Audit Service page.
ImportantStarting January 21, 2025, the entry point to the Log Audit Service console will be removed. However, it is still available to users who activated the service before this date. New users who want to use the previous version can go to the new Log Audit Service page and click Back to Old Version. For more information, see Log Audit Service (Previous Version).
In the left-side navigation pane, choose Access to Cloud Services > Global Configurations.
From the Region of Central Project drop-down list, select the target region for centralized log storage.
In the cloud service list, turn on the Operation Logs switch for bastion host and set the retention period in Storage Method.
View bastion host audit logs.
In the left-side navigation pane, click the
icon.Choose Centralization > Bastionhost to view the audit logs.
The following table describes the fields of bastion host audit logs after they are delivered to SLS.
SLS log field
Description
__topic__
The log topic. The value is always
bastionhost.owner_id
The Alibaba Cloud account ID.
region
The region where the bastion host instance resides.
content
The content of an operation, such as a character-based command or a file transfer.
event_type
The event type. For more information, see event_type details.
instance_id
The bastion host instance ID.
resource_address
The IP address of the managed asset.
resource_name
The name of the managed asset.
result
The result of an operation, such as a character-based command or a file transfer.
session_id
The unique identifier for a session.
user_client_ip
The source IP address of the user.
user_id
The bastion host user ID.
user_name
The bastion host username.
Event type
Event | Description |
db.oracle.req | Oracle database request |
db.mysql.req | MySQL database request |
db.pgsql.req | PostgreSQL database request |
cmd.Command | Command text |
cmd.Command.policy | Command processed by a control policy |
graph.Text | Graphical text |
graph.Keyboard | Graphical keyboard event |
file.Upload | Upload a file |
file.Download | Download a file |
file.Rename | Rename a file |
file.Delete | Delete a file |
file.DeleteDir | Delete a directory |
file.CreateDir | Create a directory |
login.CSLogin | CS user login |
Session.session | A user session |
The following events are supported only in V3.2.43 and later versions | |
login.CSPasswordLogin | CS login with username and password |
login.CSResetPassword | Change the CS password |
login.PortalPasswordLogin | Portal login with username and password |
user.PortalResetPassword | Change the Portal password |
user.PortalClearOTP | Clear a Portal user's OTP token |
user.PortalBindOTP | Bind an OTP token to a Portal user |
user.PortalLogout | Log out of the Portal |
login.CSTwoFactorLogin | CS two-factor authentication |
login.PortalTwoFactorLogin | Portal two-factor authentication |
user.CreateUser | Create a user |
user.DeleteUser | Delete a user |
user.ModifyUser | Modify a user |
user.LockUser | Lock a user |
user.UnlockUser | Unlock a user |
user.CreateUserPublicKey | Add a user's SSH public key |
user.ModifyUserPublicKey | Modify a user's SSH public key |
user.DeleteUserPublicKey | Delete a user's SSH public key |
user.ExportUsers | Export users |
user.SyncRemoteUserDN | Sync a remote user's DN |
user.NotifyUserOperationAddress | Modify the allowed login addresses for a user |
user.SetUserUSBKey | Bind a USBKEY certificate to a user |
user.ResetUserUSBKey | Unbind a USBKEY certificate from a user |
user.CreateUserGroup | Create a user group |
user.ModifyUserGroup | Modify a user group |
user.DeleteUserGroup | Delete a user group |
user.AddUsersToGroup | Add users to a user group |
user.RemoveUsersFromGroup | Remove user group members |
asset.CreateHost | Create a host |
asset.ModifyHost | Modify a host |
asset.DeleteHost | Delete a host |
asset.EnableHost | Enable a host |
asset.DisableHost | Disable a host |
asset.ResetHostsFingerPrint | Reset a host fingerprint |
asset.RefreshECSHostStatus | Refresh the status of an ECS host |
asset.RefreshKMSSecretsForECS | Refresh the KMS secrets for an ECS host |
asset.RefreshAssetNetworkStatus | Refresh the network status of an asset |
asset.ExportHosts | Export hosts |
asset.CreateDatabase | Create a database asset |
asset.ModifyDatabase | Modify a database asset |
asset.DeleteDatabase | Delete a database asset |
asset.EnableDatabase | Enable a database asset |
asset.DisableDatabase | Disable a database asset |
asset.RefreshRDSDatabaseStatus | Check the status of an RDS database asset |
asset.ExportDatabases | Export database assets |
asset.CreateAssetGroup | Create an asset group |
asset.ModifyAssetGroup | Modify an asset group |
asset.DeleteAssetGroup | Delete an asset group |
asset.AddHostsToGroup | Add hosts to an asset group |
asset.RemoveHostsFromGroup | Remove hosts from an asset group |
asset.AddDatabasesToGroup | Add databases to an asset group |
asset.RemoveDatabasesFromGroup | Remove databases from an asset group |
asset.AddAppsToGroup | Add applications to an asset group |
asset.RemoveAppsFromGroup | Remove applications from an asset group |
asset.CreateHostAccount | Create a host account |
asset.ModifyHostAccount | Modify a host account |
asset.DeleteHostAccount | Delete a host account |
asset.ResetHostAccountCredential | Reset host account credentials |
asset.CreateDatabaseAccount | Create a database account |
asset.ModifyDatabaseAccount | Modify a database account |
asset.DeleteDatabaseAccount | Delete a database account |
asset.CreateAssetSource | Create a third-party asset source |
asset.ModifyAssetSource | Modify a third-party asset source |
asset.DeleteAssetSource | Delete a third-party asset source |
authorization.AttachHostAccountsToUser | Attach host accounts to a user |
authorization.DetachHostAccountsFromUser | Detach host accounts from a user |
authorization.AttachHostAccountsToUserGroup | Attach host accounts to a user group |
authorization.DetachHostAccountsFromUserGroup | Remove authorized host accounts from a user group |
authorization.AttachAssetGroupAccountsToUser | Attach asset group accounts to a user |
authorization.DetachAssetGroupAccountsFromUser | Detach asset group accounts from a user |
authorization.AttachAssetGroupAccountsToUserGroup | Attach asset group accounts to a user group |
authorization.DetachAssetGroupAccountsFromUserGroup | Detach asset group accounts from a user group |
asset.AttachDatabaseAccountsToUser | Attach database accounts to a user |
asset.DetachDatabaseAccountsFromUser | Detach database accounts from a user |
asset.AttachDatabaseAccountsToUserGroup | Attach database accounts to a user group |
asset.DetachDatabaseAccountsFromUserGroup | Detach database accounts from a user group |
policy.CreatePolicy | Create a control policy |
policy.DeletePolicy | Delete a control policy |
policy.ModifyPolicy | Modify a control policy |
policy.AttachUsersToPolicy | Attach users to a control policy |
policy.DetachUsersFromPolicy | Detach users from a control policy |
policy.AttachUserGroupsToPolicy | Attach user groups to a control policy |
policy.DetachUserGroupsFromPolicy | Detach user groups from a control policy |
policy.AttachHostsToPolicy | Associate a control policy with a host |
policy.DetachHostsFromPolicy | Detach hosts from a control policy |
policy.AttachAssetGroupsToPolicy | Attach asset groups to a control policy |
policy.DetachAssetGroupsFromPolicy | Detach asset groups from a control policy |
policy.CreateDatabaseMaskPolicy | Create a data masking policy |
policy.ModifyDatabaseMaskPolicy | Modify a data masking policy |
policy.DeleteDatabaseMaskPolicy | Delete a data masking policy |
policy.AttachDatabasesToPolicy | Attach databases to a control policy |
policy.DetachDatabasesFromPolicy | Detach databases from a control policy |
policy.AttachAppsToPolicy | Attach applications to a control policy |
policy.DetachAppsFromPolicy | Detach applications from a control policy |
policy.SetPolicyUserScope | Set the user scope for a specific control policy |
policy.SetPolicyAssetScope | Set the asset scope for a specific control policy |
policy.SetHostAccountToPolicy | Specify the accounts for hosts associated with the specified control policy |
policy.SetDatabaseAccountToPolicy | Associate an account with a database under a specified control policy |
policy.SetAppAccountToPolicy | Associate a database account with a specified control policy |
policy.SetAssetGroupAccountNamesToPolicy | Set asset group accounts for asset groups attached to a specific control policy |
policy.GenerateApproveCommand | Generating command approval records |
policy.CancelApproveCommand | Cancel command approval |
policy.AcceptApproveCommand | Allow command approval |
policy.RejectApproveCommand | Reject Command Approval |
policy.GenerateApproveCommand | Create a command approval |
task.CreatePasswordTask | Create a change password task |
task.ModifyPasswordTask | Modify a change password task |
task.DeletePasswordTask | Delete a change password task |
task.AttachHostAccountsToPasswordTask | Associate a host account with a change password task |
task.DetachHostAccountsFromPasswordTask | Disassociate host accounts from a change password task |
task.ExecutePasswordTask | Execute a change password task |
task.CancelPasswordTask | Cancel a change password task |
task.EnablePasswordTask | Enable a change password task |
task.ExportPasswordTaskHistory | Export change password task history |
system.DeleteAuditSessionVideo | Delete session recording files |
system.ModifyInstanceTwoFactor | Modify two-factor authentication configuration |
system.InterruptAuditSession | Terminate Session |
system.ImportBastionHostConfig | Import Configuration Backup |
system.ExportBastionHostConfig | Export a bastion host configuration backup |
system.ModifyInstanceLDAPAuthServer | Modify the LDAP authentication server configuration |
system.ModifyInstanceADAuthServer | Modify AD authentication server configuration |
system.AddInstanceMember | Add an RD member account for the instance |
system.RemoveInstanceMember | Remove an RD member account |
system.ModifyInstanceTLSConfig | Modify TLS security configuration |
system.ModifyDataEncryptionConfig | Modify the encryption method configuration |
system.VerifyUserInfoSignature | Signature verification of user key information |
system.BindIDaaSInstance | Bind an IDaaS instance |
system.UnbindIDaaSInstance | Unbind an IDaaS instance |
system.ModifyInstanceLoginPolicy | Modify user login configuration and user lockout policy configuration |
system.ModifyInstanceUserPolicy | Modify user password security and user status configurations |
system.CreateInstanceADAuthServer | Create an AD authentication server instance |
system.DeleteInstanceADAuthServer | Delete an AD authentication server for an instance |
system.ModifyInstanceIDaaSConfig | Modify a bound IDaaS instance configuration |
system.ModifyInstanceOperationConfig | Modify instance O&M configuration |
system.ModifyInstanceAssetPolicy | Modify the connectivity check interval configuration |
system.AddInstanceNotificationReceiveUser | Add an alert administrator to receive message notifications. |
system.RemoveInstanceNotificationReceiveUser | Remove alert notification recipients |
system.ModifyInstanceNotificationConfig | Modify message notification configuration |
system.ModifyInstanceStorePolicy | Modify automatic deletion configuration for session recordings |
system.ModifyInstanceSessionPolicy | Modify the automatic cleanup configuration for the session list |
audit.DownloadOperationEventsBackup | Download an O&M event log backup |
audit.ExportOperationAuditReport | Export O&M reports |
audit.DownloadAutoOperationTaskOutput | Download automated O&M task results |
asset.CreateHostShareKey | Create a shared key |
asset.ModifyHostShareKey | Edit shared key |
asset.DeleteHostShareKey | Delete a shared key |
asset.AttachHostAccountsToHostShareKey | Associating a shared key with a host account |
asset.DetachHostAccountsFromHostShareKey | Disassociate a host account from a shared key |
asset.CreateNetworkDomain | Create a network domain |
asset.ModifyNetworkDomain | Edit network domain |
asset.DeleteNetworkDomain | Delete a network domain |
asset.MoveHostsToNetworkDomain | Modify a host's network domain |
asset.MoveDatabasesToNetworkDomain | Modify the network domain of a database |
authorization.CreateRule | Create an authorization rule |
authorization.ModifyRule | Modify authorization rule |
authorization.DeleteRule | Delete an authorization rule |
authorization.EnableRule | Enable an authorization rule |
authorization.DisableRule | Disable authorization rule |
authorization.ExportAuthorizationRelation | Export authorization relationships |
operation.CreateOperationTicket | Create an O&M approval work order |
operation.AcceptOperationTicket | Allow O&M requests |
operation.RejectOperationTicket | Reject an O&M request |
operation.CancelOperationTicket | Cancel O&M Request |
task.CreateAutoOperationTask | Create an O&M task |
task.ModifyAutoOperationTask | Modify an O&M task |
task.DeleteAutoOperationTask | Delete an O&M task |
task.StartAutoOperationTask | Start an O&M task |
task.StopAutoOperationTask | Stopping an O&M task |
task.CreateAutoOperationScript | Create an O&M script |
task.ModifyAutoOperationScript | Modify O&M script |
task.DeleteAutoOperationScript | Delete an O&M script |
task.AcceptOperationTaskApproval | Allow automatic O&M task tickets |
task.RejectOperationTaskApproval | Reject an automated O&M task work order |
task.CancelAutoOperationTask | Cancel O&M task request |
asset.ImportKMSSecretsForHost | Import KMS secrets |
operation.ConnectAsset | Connect assets |
operation.LoginAsset | Log in to an asset |
operation.LogoutAsset | Log out of an asset |
operation.SetOperationSSOConfig | Modify single sign-on settings for the O&M terminal |
operation.ModifyOperationUserProfile | An O&M user modifies their personal information. |
asset.CreateAppServer | Create an application server |
asset.ModifyAppServer | Modify an application server |
asset.DeleteAppServers | Delete application server |
asset.SyncAppServerAccount | Synchronize application server accounts |
asset.CreateAppTool | Create remote client tool |
asset.ModifyAppTool | Modify the remote client tool |
asset.DeleteAppTools | Remove the remote client tool |
asset.CreateApp | Create an application |
asset.ModifyApp | Modify application |
asset.DeleteApps | Delete application |
asset.DeleteApp | Delete a single application |
asset.CreateAppAccount | Create an application account |
asset.ModifyAppAccount | Modify application account |
asset.DeleteAppAccounts | Delete application account |
asset.AttachAppAccountsToUser | Add an authorized application account to a user |
asset.DetachAppAccountsFromUser | Detach an application account from a user |
asset.AttachAppAccountsToUserGroup | Add an application account attached to a user group |
asset.DetachAppAccountsFromUserGroup | Detach application accounts from a user group |