Field details for Redis audit logs, slow logs, and run logs. - Simple Log Service

Redis provides audit logs, slow logs, and run logs. This topic describes the fields for each log type.

Audit log

The audit log is stored in a Logstore named redis_audit_log_standard. The following table describes the fields.

Field	Description
__topic__	The log topic. `redis_audit_log`: audit log from a DB node `redis_proxy_audit_log`: audit log from a Proxy node
account	The name of the database account.
command	The executed Redis command. If `type` is `7` (hot key log) or `8` (large key log), this field is a JSON array containing details about hot keys or large keys, respectively. The following tables describe the fields in each array element.
db	The name of the database.
extend_information	Additional information.
instanceid	The Redis instance ID.
ip	The IP address.
is_cautious	Indicates whether the operation is high-risk. `0`: No `1`: Yes
latency	The command execution latency. For logs from a DB node, latency is in microseconds. For logs from a Proxy node, latency is in milliseconds.
time	The timestamp. Example: 1597048424.
type	The type of log. Valid values: `0`: primary node write `7`: primary node hot key log `8`: primary node large key log `1024`: write to a primary node by an admin account

When type is 7 (hot key log), the following table describes the fields of each element in the command array.

Field	Type	Description
category	string	The method used to identify a hot key. A value of "traffic" indicates identification by traffic. A value of "qps" or the absence of this field indicates identification by QPS.
dbid	long	The database where the key is located. Example: `0`.
key	string	The specific key. Example: `"key:000000000095"`.
type	string	The data type of the key. Example: `"string"`.
lfu	long	This field can be ignored. It was used in earlier engine versions and is returned only for hot keys identified based on QPS.
qps	number\|string	The access frequency. Examples: `26865`, `5500-6000`, and `>=6000`. Note: The data type of this field is number in newer engine versions but string in some earlier versions.
in_bytes	long	The ingress traffic. This field is returned only when `category` is `"traffic"`.
out_bytes	long	The egress traffic. This field is returned only when `category` is `"traffic"`.

When type is 8 (large key log), the following table describes the fields of each element in the command array.

Field	Type	Description
dbid	text	The database where the key is located. Example: `"0"`.
key	text	The specific key. Example: `"key:000000000095"`.
type	text	The data type of the key. Example: `"string"`. Note: In open-source Redis and some earlier Tair versions, a string key is logged as a large key if its length exceeds the threshold (default: 2000).
size	long	The number of elements. Example: 1024.

The slow log is stored in a Logstore named redis_slow_run_log. The following table describes the fields.

Field	Description
__topic__	The log topic. `redis_slow_log`: slow log from a DB node `redis_proxy_slow_log`: slow log from a Proxy node
account	The name of the database account.
command	The executed Redis command.
db	The name of the database.
extend_information	Additional information.
instanceid	The Redis instance ID.
ip	The IP address.
is_cautious	Indicates whether the operation is high-risk. `0`: No `1`: Yes
latency	The command execution latency. For logs from a DB node, latency is in microseconds. For logs from a Proxy node, latency is in milliseconds.
time	The timestamp. Example: 1597048424.
type	The type of log.

The run log is stored in a Logstore named redis_slow_run_log. The following table describes the fields.

Field	Description
__topic__	The log topic. The value is always `redis_run_log`.
extend_information	Additional information.
instanceid	The Redis instance ID.
node_type	The source node of the run log. `proxy`: run log from a Proxy node `db`: run log from a DB node
runlog	The run log content.
time	The timestamp. Example: 1597048424.