Simple Log Service での SQL ステートメントによる ActionTrail イベントクエリ - ActionTrail - Alibaba Cloud - ActionTrail

ActionTrail は、直近 90 日間のイベントを記録します。過去のイベントをクエリして分析するには、トレイルを作成してイベントを Simple Log Service (SLS) に配信し、SLS で SQL ステートメントを使用します。

SQL ステートメントの構文

SQL ステートメントは、次のフォーマットです： <Query statement> | <Analytic statement>。

次の表に、サポートされている各クエリ方法のクエリステートメントと分析ステートメントを示します。

クエリ方法	クエリステートメント	分析ステートメント
イベントクエリ	読み取り/書き込みタイプ： `* AND "event.eventCategory": Management AND "event.eventRW": Write` ユーザー名： `* AND "event.eventCategory": Management AND "event.userIdentity.userName": "xxx"` イベント名： `* AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"` リソースタイプ： `* AND "event.eventCategory": Management AND "event.resourceType": "ACS::ECS::Instance"` リソース名： `* AND "event.eventCategory": Management AND "event.resourceName": "i-xxx"` サービス名： `* AND "event.eventCategory": Management AND "event.serviceName": "Ecs"` AccessKey ID： `* AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"` ソース IP アドレス： `* AND "event.eventCategory": Management AND "event.sourceIpAddress": "10.12.XX.XX"`	select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accontId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName
イベント集計クエリ	読み取り/書き込みタイプ： `* AND "event.eventCategory": Management AND "event.eventRW": Write` イベント名： `* AND "event.eventCategory": Management AND "event.eventName": "DescribeScalingGroups"` サービス名： `* AND "event.eventCategory": Management AND "event.serviceName": "ECS"` AccessKey ID： `* AND "event.eventCategory": Management "event.userIdentity.accessKeyId": "STS.xxxx"`	SELECT "event.serviceName" AS servieName, "event.eventName" AS eventName, "event.eventRW" AS eventRw, "event.sourceIpAddress" AS sourceIpAddress, "event.resourceName" AS resourceName, "event.resourceType" AS resourceType, "event.userIdentity.userName" AS userName, "event.userIdentity.type" AS userType, "event.userIdentity.accessKeyId" AS accessKeyId, "event.acsRegion" AS eventRegion, COUNT("event.eventId") AS n, date_trunc('hour', __time__) AS time GROUP BY time, servieName, eventName, eventRw, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20
Insight イベントクエリ	IP アドレス： `* AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.insightDetails.sourceIpAddress": "10.12.XX.XX"` Insight イベントタイプ： `* AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight` イベント ID： `* AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight AND "event.eventId": 6CE5DBDE-5D18-4BF9-BD6A-E0D2E1BA****`	`select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count`

SQL ステートメントの例

例 1：書き込みタイプのすべての管理イベントのクエリ

* AND "event.eventCategory": Management AND "event.eventRW": Write | select "event.acsRegion" as acsRegion, "event.apiVersion" as apiVersion, "event.eventId" as eventId, "event.eventName" as eventName, "event.eventRW" as eventRW, "event.eventSource" as eventSource, from_unixtime(__time__) as eventTime, "event.eventType" as eventType, "event.eventVersion" as eventVersion, "event.errorCode" as errorCode, "event.errorMessage" as errorMessage, "event.requestId" as requestId, "event.requestParameterJson" as requestParameterJson, "event.resourceName" as resourceName, "event.resourceType" as resourceType, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userAgent" as userAgent, "event.userIdentity.accessKeyId" as accessKeyId, "event.userIdentity.accountId" as accontId, "event.userIdentity.principalId" as principalId, "event.userIdentity.type" as type, "event.userIdentity.userName" as userName
例 2：書き込みタイプのすべての管理イベントのサマリーのクエリ

説明
クエリに長い時間範囲を指定する場合は、ステートメントに LIMIT N を追加して N 件のイベントのみを返すようにすることを推奨します。たとえば、LIMIT 20 と設定すると、20 件のイベントが返されます。

* AND "event.eventCategory": Management AND "event.eventRW": Write | SELECT "event.serviceName" AS servieName, "event.eventName" AS eventName, "event.eventRW" AS eventRw, "event.sourceIpAddress" AS sourceIpAddress, "event.resourceName" AS resourceName, "event.resourceType" AS resourceType, "event.userIdentity.userName" AS userName, "event.userIdentity.type" AS userType, "event.userIdentity.accessKeyId" AS accessKeyId, "event.acsRegion" AS eventRegion, COUNT("event.eventId") AS n, date_trunc('hour', __time__) AS time GROUP BY time, servieName, eventName, eventRw, sourceIpAddress, resourceType, resourceName, accessKeyId, userType, userName, eventRegion ORDER BY time DESC LIMIT 20
例 3： Insight イベントにおけるすべての IP 異常のクエリ

* AND "event.eventCategory": Insight AND event.insightDetails.insightType: IpInsight | select from_unixtime(__time__) as eventTime, "event.acsRegion" as eventRegion, "event.insightDetails.sourceIpAddress" as sourceIpAddress, "event.insightDetails.insightContext.statistics.insightCount" as count
例 4：特定のソース IP アドレスを送信元とする管理イベントのクエリ

* AND "event.eventCategory": Management AND "event.sourceIpAddress": "10.12.XX.XX" | select from_unixtime(__time__) as eventTime, "event.eventName" as eventName, "event.serviceName" as serviceName, "event.sourceIpAddress" as sourceIpAddress, "event.userIdentity.userName" as userName, "event.acsRegion" as acsRegion