Elastic Compute Service:Deliver Cloud Assistant session records to SLS or OSS

Go to ECS console - Cloud Assistant.

In the upper-right corner of the ECS Cloud Assistant page, click Settings.

In the Cloud Assistant Settings dialog box, click the Session Manager Settings tab and select Deliver to Log Service.

On the right side of the Select a Logstore section, click Logstores.

• For log query and analysis, see Query and analyze logs.

• The following table describes the parameters in session record logs.

  Parameter	Description
  LoginUser	The username of the operator.
  CallerUid	The account ID of the operator.
  Content	The command and its output. The command and output are separated by equal signs (=).
  InstanceId	The instance ID.
  SessionId	The session ID.
  ChannelId	The channel ID.
  TokenPrincipalId	The principal ID that performs operations after the instance is connected with a Security Token Service (STS) role through Session Manager.

Go to ECS console - Cloud Assistant.

In the upper-right corner of the ECS Cloud Assistant page, click Settings.

In the Cloud Assistant Settings dialog box, click the Session Manager Settings tab and select Deliver to OSS.

On the right side of the Bucket section, click OSS Console.

Navigate to the directory of a specific session record object.

The OSS console opens at the root directory you specified. Session record objects are organized in subdirectories in the following format:

<Root directory>/<Region ID of the instance>/<Session record time (Year-Month)>/<Session record time (Day)>/<Instance ID>/<SessionId>/<ChannelId>

Analyze a session record object.

Session record objects are in YAML format. Download them for analysis and auditing.

The following Java code parses a session record object in YAML format:

//The document parsing class of the YAML object.
public static class Document {
    //The basic information about the session.
    private MetaData metaData;
    //The session records.
    private List<SessionData> sessionData;
}

//The basic information about the session.
public static class MetaData {
    //The parsing version of the YAML object.
    private String version;
    //The username used to perform operations.
    private String loginUser;
    //The ID of the account used to perform operations.
    private Long callerUid;
    //The ID of the instance.
    private String instanceId;
    //The ID of the session.
    private String sessionId;
    //The ID of the channel.
    private String channelId;
    //The ID of the principal that actually performs operations after the instance is connected with an STS role by using Session Manager.
    private String stsTokenPrincipalId;
}

//The session records.
public static class SessionData {
    //The time of the session record.
    private String time;
    //The command and corresponding output. In most cases, the command and the output are separated by closing angle brackets (>).
    private String content;
}

/**
* Obtain the session records of Session Manager.
*
* @param deliveryFileName. The name of the YAML object.
* @return. The session records.
*/
public Document getSessionData(String deliveryFileName) {
    Yaml yaml = new Yaml(new Constructor(Document.class));
	  File deliveryFile = new File(deliveryFileName);
	  try (InputStream deliveryInputStream = new FileInputStream(deliveryFile)) {
        Document document = (Document) yaml.load(deliveryInputStream);
        //The basic information about the session.
        //MetaData metaData = document.getMetaData();
        //The session records.
        //List<SessionData> sessionDataList = document.getSessionData();
        return document;
    } catch (IOException exception) {
        // log.error("");
    }
    return null;
}