Queries the operation logs of regular users.

Description

You can audit the operation logs of regular users to improve security. The operation logs record events such as desktop startup, shutdown, and session disconnection.

Request parameters

Parameter Type Required Example Description
Action String Yes DescribeClientEvents

The operation that you want to perform. Set the value to DescribeClientEvents.

RegionId String Yes cn-hangzhou

The ID of the region where the cloud desktop resides.

EndUserId String No 28961708130834****

The information about the regular user that connects to the cloud desktop from the EDS client. The information can be the RAM user ID or Active Directory (AD) username. If you do not specify a value for this parameter, events of all regular users in the specified region are queried.

DesktopId String No ecd-8fupvkhg0aayu****

The ID of the cloud desktop. If you do not specify a value for this parameter, events of all cloud desktops in the specified region are queried.

DesktopIp String No 10.10.*.*

The IP address of the cloud desktop. If you do not specify a value for this parameter, events of all cloud desktops in the specified region are queried.

OfficeSiteId String No cn-hangzhou+dir-bh77qa8nmjot4****

The ID of the workspace to which the cloud desktop belongs. If you do not specify a value for this parameter, events of all workspaces in the specified region are queried.

EventType String No DESKTOP_DISCONNECT

The type of event that you want to query. Valid values:

  • DESKTOP_CONNECT: The desktop session is established.
  • DESKTOP_DISCONNECT: The desktop session is disconnected.
  • DESKTOP_REBOOT: The cloud desktop is restarted.
  • CLIENT_AD_LOGIN: The AD user logs on to the client.
  • GET_CONNECTION_TICKET: The request to connect to the cloud desktop is sent.
  • DESKTOP_START: The cloud desktop is started.
  • DESKTOP_STOP: The cloud desktop is stopped.

If you do not specify a value for this parameter, events of all types are queried.

StartTime String No 2020-11-30T06:32:31Z

The beginning of the time range to query. Specify the time in the ISO 8601 standard in the YYYY-MM-DDThh:mm:ssZ format. The time must be in UTC.

If you do not specify a value for this parameter, all events that occurred before the point in time that you specify for EndTime are queried.

EndTime String No 2020-11-31T06:32:31Z

The end of the time range to query. Specify the time in the ISO 8601 standard in the YYYY-MM-DDThh:mm:ssZ format. The time must be in UTC.

If you do not specify a value for this parameter, the current time is used.

MaxResults Integer No 10

The number of entries to return on each page.

Default value: 100.

NextToken String No AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****

The query token. Set the value to the NextToken value that is returned from the last call to the DescribeClientEvents operation.

OfficeSiteName String No test

The name of the workspace.

DesktopName String No test

The name of the cloud desktop.

Response parameters

Parameter Type Example Description
NextToken String AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****

The query token that is returned in this call.

RequestId String 28A40F12-F340-442B-A35F-46EF6A03227B

The ID of the request.

Events Array of Event

Details about the events.

Status String 200

The status of the event. This parameter is returned if you set the EventType parameter to DESKTOP_DISCONNECT or GET_CONNECTION_TICKET. Valid values:

  • 200. The value indicates that the request is successful.
  • An error message. The value indicates that the request failed. Example: FailedToGetConnectionTicket.
BytesReceived String 8665

The number of bytes that are received.

DesktopIp String 10.10.*.*

The IP address of the cloud desktop.

EventTime String 2020-11-30T06:32:31Z

The time when the event occurred.

BytesSend String 2345

The number of bytes that are sent.

OfficeSiteId String cn-hangzhou+dir-bh77qa8nmjot4****

The ID of the workspace to which the cloud desktop belongs.

AliUid String 112259558861****

The ID of the Alibaba Cloud account with which the event is associated.

DesktopId String ecd-8fupvkhg0aayu****

The ID of the cloud desktop.

RegionId String cn-hangzhou

The ID of the region.

EventId String 5651188b-3070-d1cc-5311-75753d59****

The ID of the event.

DirectoryType String RAM

The type of the directory.

EventType String DESKTOP_DISCONNECT

The type of the event.

EndUserId String 28961708130834****

The information about the regular user that connects to the cloud desktop from the EDS client. The information can be the RAM user ID or AD username.

ClientIp String 100.68.*.*

The IP address of the client.

ClientOS String Darwin 17.7.0 x64

The OS that the client runs.

OfficeSiteType String SIMPLE

The account type of the workspace. Valid values:

  • SIMPLE: convenience account
  • AD_CONNECTOR: enterprise AD account
DirectoryId String cn-hangzhou+dir-bh77qa8nmjot4****

The ID of the directory to which the cloud desktop belongs.

ClientVersion String 1.0.4 202012021700

The version of the client.

OfficeSiteName String test

The name of the workspace.

DesktopName String test

The name of the cloud desktop.

DesktopGroupId String dg-kadkdfaf****

The ID of the desktop group.

DesktopGroupName String testName

The name of the desktop group.

Examples

Sample requests

http(s)://ecd.cn-hangzhou.aliyuncs.com/?Action=DescribeClientEvents
&RegionId=cn-hangzhou
&<Common request parameters>

Sample success responses

XML format

HTTP/1.1 200 OK
Content-Type:application/xml

<DescribeClientEventsResponse>
    <NextToken>AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****</NextToken>
    <RequestId>28A40F12-F340-442B-A35F-46EF6A03227B</RequestId>
    <Events>
        <Status>200</Status>
        <BytesReceived>8665</BytesReceived>
        <DesktopIp>10.10.*.*</DesktopIp>
        <EventTime>2020-11-30T06:32:31Z</EventTime>
        <BytesSend>2345</BytesSend>
        <OfficeSiteId>cn-hangzhou+dir-bh77qa8nmjot4****</OfficeSiteId>
        <AliUid>112259558861****</AliUid>
        <DesktopId>ecd-8fupvkhg0aayu****</DesktopId>
        <RegionId>cn-hangzhou</RegionId>
        <EventId>5651188b-3070-d1cc-5311-75753d59****</EventId>
        <DirectoryType>RAM</DirectoryType>
        <EventType>DESKTOP_DISCONNECT</EventType>
        <EndUserId>28961708130834****</EndUserId>
        <ClientIp>100.68.*.*</ClientIp>
        <ClientOS>Darwin 17.7.0 x64</ClientOS>
        <OfficeSiteType>SIMPLE</OfficeSiteType>
        <DirectoryId>cn-hangzhou+dir-bh77qa8nmjot4****</DirectoryId>
        <ClientVersion>1.0.4 202012021700</ClientVersion>
        <OfficeSiteName>test</OfficeSiteName>
        <DesktopName>test</DesktopName>
        <DesktopGroupId>dg-kadkdfaf****</DesktopGroupId>
        <DesktopGroupName>testName</DesktopGroupName>
    </Events>
</DescribeClientEventsResponse>

JSON format

HTTP/1.1 200 OK
Content-Type:application/json

{
  "NextToken" : "AAAAAV3MpHK1AP0pfERHZN5pu6nmB7qrRFJ8vmttjxPL****",
  "RequestId" : "28A40F12-F340-442B-A35F-46EF6A03227B",
  "Events" : [ {
    "Status" : "200",
    "BytesReceived" : "8665",
    "DesktopIp" : "10.10.*.*",
    "EventTime" : "2020-11-30T06:32:31Z",
    "BytesSend" : "2345",
    "OfficeSiteId" : "cn-hangzhou+dir-bh77qa8nmjot4****",
    "AliUid" : "112259558861****",
    "DesktopId" : "ecd-8fupvkhg0aayu****",
    "RegionId" : "cn-hangzhou",
    "EventId" : "5651188b-3070-d1cc-5311-75753d59****",
    "DirectoryType" : "RAM",
    "EventType" : "DESKTOP_DISCONNECT",
    "EndUserId" : "28961708130834****",
    "ClientIp" : "100.68.*.*",
    "ClientOS" : "Darwin 17.7.0 x64",
    "OfficeSiteType" : "SIMPLE",
    "DirectoryId" : "cn-hangzhou+dir-bh77qa8nmjot4****",
    "ClientVersion" : "1.0.4 202012021700",
    "OfficeSiteName" : "test",
    "DesktopName" : "test",
    "DesktopGroupId" : "dg-kadkdfaf****",
    "DesktopGroupName" : "testName"
  } ]
}