Tous les produits
Search

Ce produit

    ActionTrail:Interroger les événements ActionTrail dans Simple Log Service à l'aide d'instructions SQL

    Centre de documentation

    ActionTrail:Interroger les événements ActionTrail dans Simple Log Service à l'aide d'instructions SQL

    Dernière mise à jour :Sep 09, 2026

    ActionTrail conserve les événements pendant 90 jours. Pour interroger et analyser des événements plus anciens, créez une piste pour acheminer les événements vers Simple Log Service (SLS), puis utilisez des instructions SQL dans SLS.

    Syntaxe des instructions SQL

    Les instructions SQL respectent le format suivant : <Query statement> | <Analytic statement>.

    Le tableau ci-dessous répertorie les instructions de requête et d'analyse pour chaque méthode de requête prise en charge.

    Méthode de requête

    Instruction de requête

    Instruction d'analyse

    Requête d'événements

    • Par type de lecture/écriture : * AND "event.eventCategory": Management AND "event.eventRW": Write

    • Par nom d'utilisateur : * AND "event.eventCategory": Management AND "event.userIdentity.userName": "xxx"

    • Par nom d'événement : * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

    • Par type de ressource : * AND "event.eventCategory": Management AND "event.resourceType": "ACS::ECS::Instance"

    • Nom de la ressource : * AND "event.eventCategory": Management AND "event.resourceName": "i-xxx"

    • Nom du service : * AND "event.eventCategory": Management AND "event.serviceName": "Ecs"

    • Par AccessKey ID : * AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"

    • Par adresse IP source : * AND "event.eventCategory": Management AND "event.sourceIpAddress": "10.12.XX.XX"

    select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accontId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName

    Résumé des événements

    • Type de lecture/écriture : * AND "event.eventCategory": Management AND "event.eventRW": Write

    • Nom de l'événement : * AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"

    • Nom du service : * AND "event.eventCategory": Management AND "event.serviceName": "ECS"

    • Par AccessKey ID : * AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"

    SELECT"event.serviceName"AS servieName,"event.eventName"AS eventName,"event.eventRw"AS eventRw,"event.sourceIpAddress"AS sourceIpAddress,"event.resourceName"AS resourceName,"event.resourceType"AS resourceType,"event.userIdentity.userName"AS userName,"event.userIdentity.type"AS userType,"event.userIdentity.accessKeyId"AS accessKeyId,"event.acsRegion"AS eventRegion,COUNT("event.eventId")AS n, date_trunc('hour', __time__) AS time GROUP BY time, servieName, eventName, eventRw, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

    Événements Insight

    • Par adresse IP : * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.insightDetails.sourceIpAddress": "10.12.XX.XX"

    • Par type d'événement Insight : * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight

    • Par ID d'événement : * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.eventId": 6CE5DBDE-5D18-4BF9-BD6A-E0D2E1BA****

    select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count

    Exemples d'instructions SQL

    • Exemple 1 : Interroger tous les événements de gestion de type écriture

      * AND "event.eventCategory": Management AND "event.eventRW": Write | select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accountId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName

    • Exemple 2 : Interroger les résumés de tous les événements de gestion de type écriture

      Remarque

      Si vous spécifiez une plage de temps étendue pour votre requête, nous vous recommandons d'ajouter LIMIT N à l'instruction afin de renvoyer uniquement N événements. Par exemple, définir LIMIT 20 renvoie 20 événements.

      * AND "event.eventCategory": Management AND "event.eventRW": Write | SELECT "event.serviceName" AS serviceName, "event.eventName" AS eventName, "event.eventRW" AS eventRW, "event.sourceIpAddress" AS sourceIpAddress, "event.resourceName" AS resourceName, "event.resourceType" AS resourceType, "event.userIdentity.userName" AS userName, "event.userIdentity.type" AS userType, "event.userIdentity.accessKeyId" AS accessKeyId, "event.acsRegion" AS eventRegion, COUNT("event.eventId") AS n, date_trunc('hour', __time__) AS time GROUP BY time, serviceName, eventName, eventRW, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20

    • Exemple 3 : Interroger toutes les anomalies d'adresse IP dans les événements Insight

      * AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight | select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count

    • Exemple 4 : Interroger les événements de gestion initiés depuis une adresse IP source spécifique

      * AND "event.eventCategory": Management AND "event.sourceIpAddress": "10.12.XX.XX" | select from_unixtime(__time__) as eventTime, "event.eventName" as eventName, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userIdentity.userName" as userName, "event.acsRegion" as acsRegion