Tous les produits
Search

Ce produit

    ActionTrail:Interroger les événements ActionTrail dans Simple Log Service à l'aide d'instructions SQL

    Centre de documentation

    ActionTrail:Interroger les événements ActionTrail dans Simple Log Service à l'aide d'instructions SQL

    Dernière mise à jour :Aug 09, 2026

    ActionTrail conserve les événements des 90 derniers jours. Pour interroger et analyser des événements plus anciens, créez une piste afin d'acheminer les événements vers Simple Log Service (SLS), puis utilisez des instructions SQL dans SLS.

    Syntaxe des instructions SQL

    Les instructions SQL suivent le format suivant : <Query statement> | <Analytic statement>.

    Le tableau ci-dessous répertorie les instructions de requête et d'analyse pour chaque méthode d'interrogation prise en charge.

    Méthode de requête

    Instruction de requête

    Instruction d'analyse

    Requête d'événements

    • Par type de lecture/écriture : * AND "event.eventCategory": Management AND "event.eventRW": Write

    • Par nom d'utilisateur : * AND "event.eventCategory": Management AND "event.userIdentity.userName": "xxx"

    • Par nom d'événement : * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

    • Par type de ressource : * AND "event.eventCategory": Management AND "event.resourceType": "ACS::ECS::Instance"

    • Par nom de ressource : * AND "event.eventCategory": Management AND "event.resourceName": "i-xxx"

    • Par nom de service : * AND "event.eventCategory": Management AND "event.serviceName": "Ecs"

    • Par AccessKey ID : * AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"

    select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accontId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName

    Résumé des événements

    • Type de lecture/écriture : * AND "event.eventCategory": Management AND "event.eventRW": Write

    • Nom de l'événement : * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

    • Nom du service : * AND "event.eventCategory": Management AND "event.serviceName": "ECS"

    • Par AccessKey ID : * AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"

    SELECT"event.serviceName"AS servieName,"event.eventName"AS eventName,"event.eventRw"AS eventRw,"event.sourceIpAddress"AS sourceIpAddress,"event.resourceName"AS resourceName,"event.resourceType"AS resourceType,"event.userIdentity.userName"AS userName,"event.userIdentity.type"AS userType,"event.userIdentity.accessKeyId"AS accessKeyId,"event.acsRegion"AS eventRegion,COUNT("event.eventId")AS n, date_trunc('hour', __time__) AS time GROUP BY time, servieName, eventName, eventRw, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

    Événements Insight

    • Par adresse IP : * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.insightDetails.sourceIpAddress": "10.12.XX.XX"

    • Par type d'événement Insight : * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight

    • Par ID d'événement : * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.eventId": 6CE5DBDE-5D18-4BF9-BD6A-E0D2E1BA****

    select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count

    Exemples d'instructions SQL

    • Exemple 1 : Interroger tous les événements de gestion de type écriture

      * AND "event.eventCategory": Management AND "event.eventRW": Write | select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accountId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName

    • Exemple 2 : Interroger les résumés de tous les événements de gestion de type écriture

      Remarque

      Si vous spécifiez une plage de temps étendue pour votre requête, nous vous recommandons d'ajouter LIMIT N à l'instruction afin de ne renvoyer que N événements. Par exemple, définir LIMIT 20 renvoie 20 événements.

      * AND "event.eventCategory": Management AND "event.eventRW": Write | SELECT "event.serviceName" AS serviceName, "event.eventName" AS eventName, "event.eventRW" AS eventRW, "event.sourceIpAddress" AS sourceIpAddress, "event.resourceName" AS resourceName, "event.resourceType" AS resourceType, "event.userIdentity.userName" AS userName, "event.userIdentity.type" AS userType, "event.userIdentity.accessKeyId" AS accessKeyId, "event.acsRegion" AS eventRegion, COUNT("event.eventId") AS n, date_trunc('hour', __time__) AS time GROUP BY time, serviceName, eventName, eventRW, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

    • Exemple 3 : Interroger toutes les anomalies IP dans les événements Insight

      * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight | select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count