yexinru/doc-exports
1
0
Fork 0
forked from docs/doc-exports
Code Pull Requests Activity

CTS UMN 1122 version

Browse Source 
Reviewed-by: Hasko, Vladimir <vladimir.hasko@t-systems.com>
Co-authored-by: Ying, Jiayu <jiayuying1@huawei.com>
Co-committed-by: Ying, Jiayu <jiayuying1@huawei.com>
This commit is contained in:
Ying, Jiayu
2022-12-09 10:01:38 +00:00
committed by zuul
parent 54b39691a8
commit 947c3381e0
124 changed files with 10379 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

902
docs/cts/umn/ALL_META.TXT.json Normal file
View File

File diff suppressed because it is too large Load Diff

812
docs/cts/umn/CLASS.TXT.json Normal file
View File

File diff suppressed because it is too large Load Diff

3
docs/cts/umn/PARAMETERS.txt Normal file
View File

@ -0,0 +1,3 @@
version=""
language="en-us"
type=""

122
docs/cts/umn/cts_0827.html Normal file
View File

File diff suppressed because it is too large Load Diff

11
docs/cts/umn/cts_faq_001.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_001"></a><a name="cts_faq_001"></a>
<h1 class="topictitle1">Can I Create Multiple Trackers?</h1>
<div id="body1464057168910"><p id="cts_faq_001__p11827335103441">Currently, only one tracker can be created for each tenant.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

11
docs/cts/umn/cts_faq_002.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_002"></a><a name="cts_faq_002"></a>
<h1 class="topictitle1">Which Type of Information Is Displayed on the Trace List?</h1>
<div id="body1464057168910"><p id="cts_faq_002__p8060118">The trace list displays details about operations, such as creation, configuration, and deletion of cloud service resources, in your account. The trace list does not record information about query operations.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

11
docs/cts/umn/cts_faq_003.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_003"></a><a name="cts_faq_003"></a>
<h1 class="topictitle1">Can I Delete Traces from the Trace List?</h1>
<div id="body1464057168911"><p id="cts_faq_003__p49114214153458">No. Audit logs must be objective, complete, and accurate. Therefore, they cannot be deleted or modified.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

12
docs/cts/umn/cts_faq_005.html Normal file
View File

@ -0,0 +1,12 @@
<a name="cts_faq_005"></a><a name="cts_faq_005"></a>
<h1 class="topictitle1">What Are the Recommended Users of CTS?</h1>
<div id="body1481802609181"><p id="cts_faq_005__p55207703174135">It is highly recommended that cloud users enable CTS.</p>
<ul id="cts_faq_005__ul3687642917429"><li id="cts_faq_005__li6345240817429">CTS is core to information security audit. It is an essential part of security risk control for information systems in enterprises and public sectors, and is also necessary for compliance of many industry standards and audit specifications.</li><li id="cts_faq_005__li55443176174213">CTS helps accelerate troubleshooting and reduces manpower costs when exceptions occur on cloud resources. With CTS, you can track all operations involved when an exception happens, which helps narrow the possibilities.</li></ul>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

11
docs/cts/umn/cts_faq_006.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_006"></a><a name="cts_faq_006"></a>
<h1 class="topictitle1">How Long Can Trace Files Be Retained?</h1>
<div id="body1481802609181"><p id="cts_faq_006__p62577924195744">By default, trace files of the last seven days can be retained on the management console. Archived trace files stored in the OBS bucket can be permanently retained.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

12
docs/cts/umn/cts_faq_007.html Normal file
View File

@ -0,0 +1,12 @@
<a name="cts_faq_007"></a><a name="cts_faq_007"></a>
<h1 class="topictitle1">What Will Happen If I Have Enabled CTS But Have Not Configured a Correct Policy for the OBS Bucket?</h1>
<div id="body1481802609181"><p id="cts_faq_007__p3378434720958">CTS will deliver trace files based on the existing OBS bucket policy. If the policy is incorrectly configured, CTS may not deliver trace files to the OBS bucket.</p>
<p id="cts_faq_007__p2441688220227">If an OBS bucket has been deleted or encounters an exception, an error message will be displayed on the management console. In this case, you can choose to create an OBS bucket or reconfigure the access permissions of the OBS bucket. For detailed operations, see the "Bucket Management" section in the <em id="cts_faq_007__i842352697151554">Object Storage Service User Guide</em>.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

11
docs/cts/umn/cts_faq_009.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_009"></a><a name="cts_faq_009"></a>
<h1 class="topictitle1">Will Performance of Other Cloud Service Resources Be Affected If I Enable CTS?</h1>
<div id="body1481802609182"><p id="cts_faq_009__p8060118">No. Enabling CTS does not affect the performance of other cloud resources.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

12
docs/cts/umn/cts_faq_010.html Normal file
View File

@ -0,0 +1,12 @@
<a name="cts_faq_010"></a><a name="cts_faq_010"></a>
<h1 class="topictitle1">Why Are Fields of Some Traces Displayed as Null on the View Trace Page?</h1>
<div id="body1484125680311"><p id="cts_faq_010__p1123882619517">Fields <strong id="cts_faq_010__b1736554410133">resource_IP</strong>, <strong id="cts_faq_010__b7377144411137">code</strong>, <strong id="cts_faq_010__b173781447134">request</strong>, <strong id="cts_faq_010__b13791644191319">response</strong>, and <strong id="cts_faq_010__b1637910441133">message</strong> can be null. These fields are not mandatory for CTS.</p>
<ul id="cts_faq_010__ul13442867174245"><li id="cts_faq_010__li53876940174245"><strong id="cts_faq_010__b2708125281713">resource_IP</strong>: If the value of <strong id="cts_faq_010__b916194232411">trace_type</strong> is <strong id="cts_faq_010__b842352706155737">SystemAction</strong>, the operation is triggered by the system. It is normal that the <strong id="cts_faq_010__b842352706164856">resource_IP</strong> field is empty.</li><li id="cts_faq_010__li15130414174245"><strong id="cts_faq_010__b842352706163540">request</strong>, <strong id="cts_faq_010__b842352706163543">response</strong>, and <strong id="cts_faq_010__b842352706163546">code</strong>: These three fields indicate the request content, request result, and HTTP return code of an operation. In some cases, these fields are empty or have no service meaning. Therefore, they are left blank based on actual situations.</li><li id="cts_faq_010__li1956002174245"><strong id="cts_faq_010__b84235270616398">message</strong>: This is a reserved field. Additional information of other cloud services will be added in this field when necessary. It is normal that it is left blank.</li></ul>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

11
docs/cts/umn/cts_faq_011.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_011"></a><a name="cts_faq_011"></a>
<h1 class="topictitle1">Why Are the Resource IDs of Some Traces in the Trace List Hyperlinks?</h1>
<div id="body1484128559417"><p id="cts_faq_011__p18858355165249">For ECS, EVS, VBS, IMS, AS, Cloud Eye, and VPC, you can click <strong id="cts_faq_011__b842352706145421">Resource ID</strong> of some traces to go to the resource details page. The resource ID of such a trace is a hyperlink. More traces will be supported in future.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

13
docs/cts/umn/cts_faq_012.html Normal file
View File

@ -0,0 +1,13 @@
<a name="cts_faq_012"></a><a name="cts_faq_012"></a>
<h1 class="topictitle1">Why Is an Operation Recorded Twice in the Trace List?</h1>
<div id="body1486112893055"><p id="cts_faq_012__p3215496317835">For an asynchronously invoked trace, two records with the same trace name, resource type, and resource name will be generated. The two records may seem to be the same. However, they are generated at different times and document different details.</p>
<ul id="cts_faq_012__ul2739855617957"><li id="cts_faq_012__li5102020017957">The first record documents the request initiated by a user.</li><li id="cts_faq_012__li6383658017957">The second record documents the response to the request and the operation result, and is usually several minutes later than the first record.</li></ul>
<p id="cts_faq_012__p552462917835">The two records together give a full view of the operation.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

11
docs/cts/umn/cts_faq_013.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_013"></a><a name="cts_faq_013"></a>
<h1 class="topictitle1">Why Are <strong id="b25462020114511">user_name</strong> and <strong id="b1547162034517">op_service</strong> Displayed When I Filter Traces by User?</h1>
<div id="body1497584695839"><p id="cts_faq_013__p26404530114543">If you submit a request that calls operations requiring high permissions or calling of other services, you may not have the required permissions. In this case, your permissions will be elevated temporarily on condition that security requirements are met. Your permissions will be resumed after the request is processed, but the permissions elevation will be recorded in CTS logs and the operation user is recorded as <strong id="cts_faq_013__b116082544517">user_name</strong> or <strong id="cts_faq_013__b6617256454">op_service</strong>.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

12
docs/cts/umn/cts_faq_015.html Normal file
View File

@ -0,0 +1,12 @@
<a name="cts_faq_015"></a><a name="cts_faq_015"></a>
<h1 class="topictitle1">What Services Are Supported for Key Event Notification?</h1>
<div id="body1503307226953"><p id="cts_faq_015__p48272697172133">Currently, CTS only sends notifications for some key operations on ECS, EVS, VPC, KMS, IAM, and native OpenStack. This feature currently supports creation, deletion, login, and native OpenStack API operations. This function is still being improved and will support more services and operation types in the future. For details, see <a href="en-us_topic_0059288681.html">Configuring a Tracker</a>.</p>
<p id="cts_faq_015__p61937348145311"></p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

11
docs/cts/umn/cts_faq_017.html Normal file
View File

@ -0,0 +1,11 @@
<a name="cts_faq_017"></a><a name="cts_faq_017"></a>
<h1 class="topictitle1">Which Type of OBS Buckets Is Suitable for CTS to Store Traces?</h1>
<div id="body1514000583255"><p id="cts_faq_017__p20831725114510">OBS provides three storage classes of buckets for storage, respectively standard access, infrequent access, or archive. You must select a standard OBS bucket because CTS needs to frequently access the OBS bucket that stores traces.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

12
docs/cts/umn/cts_faq_019.html Normal file
View File

@ -0,0 +1,12 @@
<a name="cts_faq_019"></a><a name="cts_faq_019"></a>
<h1 class="topictitle1">Why Are <strong id="b842352706105319">user</strong> and <strong id="b842352706105322">source_ip</strong> Empty for Some Traces with <strong id="b842352706105446">trace_type</strong> as <strong id="b842352706105450">systemAction</strong>?</h1>
<div id="body1518070250569"><p id="cts_faq_019__p33589534141239">The <strong id="cts_faq_019__b842352706104545">trace_type</strong> field indicates the request resource. This field can be <strong id="cts_faq_019__b842352706104658">ConsoleAction</strong>, <strong id="cts_faq_019__b84235270610471">ApiCall</strong>, and <strong id="cts_faq_019__b84235270610475">SystemAction</strong>.</p>
<p id="cts_faq_019__p8060118"><strong id="cts_faq_019__b1768110039104714">SystemAction</strong> indicates that the operations are not triggered by users, such as automatic alarms, elastic scaling, scheduled backup tasks, and secondary invocations generated within the system to respond to the user's request. In this case, no user or device that triggers an operation exists. Therefore, <strong id="cts_faq_019__b1594489848105933">user</strong> and <strong id="cts_faq_019__b1881962885105933">source_ip</strong> are both empty.</p>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

12
docs/cts/umn/cts_faq_020.html Normal file
View File

@ -0,0 +1,12 @@
<a name="cts_faq_020"></a><a name="cts_faq_020"></a>
<h1 class="topictitle1">What Are the Meanings of the Three Trace Statuses?</h1>
<div id="body1526265334999"><div class="p" id="cts_faq_020__p101512744619">The trace status is defined based on <strong id="cts_faq_020__b8423527061559">trace_status</strong> information recorded in a trace. Different fields have different meanings as follows:<ul id="cts_faq_020__ul41976214489"><li id="cts_faq_020__li18197132114819"><strong id="cts_faq_020__b842352706145929">normal</strong>: indicates that this operation succeeded.</li><li id="cts_faq_020__li719719216481"><strong id="cts_faq_020__b8423527061508">warning</strong>: indicates that this operation failed.</li><li id="cts_faq_020__li7197122154814"><strong id="cts_faq_020__b84235270615025">incident</strong>: indicates that this operation causes a more serious consequence than a failure, for example, causing a node failure or service interruption.</li></ul>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030932518.html">FAQs</a></div>
</div>
</div>

23
docs/cts/umn/en-us_cts_01_0001.html Normal file
View File

@ -0,0 +1,23 @@
<a name="en-us_cts_01_0001"></a><a name="en-us_cts_01_0001"></a>
<h1 class="topictitle1">Configuring Key Event Notifications</h1>
<div id="body1527477208746"><div class="section" id="en-us_cts_01_0001__section227013810565"><h4 class="sectiontitle">Scenarios</h4><div class="p" id="en-us_cts_01_0001__p10532203716237">You can configure key event notifications on CTS so that Simple Message Notification (SMN) can send messages to notify you of key operations. This function is triggered by CTS, but notifications are sent by SMN. This function is used in the following scenarios:<ul id="en-us_cts_01_0001__ul134761051152412"><li id="en-us_cts_01_0001__li11476145172419">Real-time detection and confirmation of high-risk operations (such as VM restart and security configuration changes), cost-sensitive operations (such as creating and deleting expensive resources), and service-sensitive operations (such as network configuration changes)</li><li id="en-us_cts_01_0001__li114761251192411">Detection and confirmation of unauthorized operations and operations such as logging in with high permissions</li><li id="en-us_cts_01_0001__li10476165182416">Interconnecting with your own audit system: All audit logs are synchronized to your audit system in real time for analysis of API calling success rate, unauthorized operations, security, and costs.</li></ul>
</div>
</div>
<div class="section" id="en-us_cts_01_0001__section166121016175719"><h4 class="sectiontitle">Note</h4><ul id="en-us_cts_01_0001__ul20763052155613"><li id="en-us_cts_01_0001__li17631852165614">Key event notifications are sent to subscribers by SMN. Therefore, before using CTS, you need to know how to create topics and add subscriptions on the SMN console.</li><li id="en-us_cts_01_0001__li376315523566">Currently, you can create 100 key event notifications in CTS and specify key operations, users, and topics for each notification.</li><li id="en-us_cts_01_0001__li1176310526561">You can configure a maximum of 50 users in 10 user groups in key event notifications. For each notification, you can select multiple users in a same user group.</li><li id="en-us_cts_01_0001__li14763145210568">You can select a maximum of 1000 key operations of 100 cloud services for each notification.</li><li id="en-us_cts_01_0001__li276345214564">Key event notification is an upgraded version of the original notification function. It is more powerful and provides more configuration items.</li></ul>
</div>
<div class="section" id="en-us_cts_01_0001__section50451709105654"><h4 class="sectiontitle">Procedure</h4><ol id="en-us_cts_01_0001__ol5786112111231"><li id="en-us_cts_01_0001__li5098804111231">Log in to the management console.</li><li id="en-us_cts_01_0001__li34647912162648">Click <span><img id="en-us_cts_01_0001__image731825183810" src="en-us_image_0237964518.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_cts_01_0001__li6039246711240">Click <strong id="en-us_cts_01_0001__b4830253031137">Service List</strong> and choose <strong id="en-us_cts_01_0001__b59726530172139">Management &amp; Deployment &gt; Cloud Trace Service</strong>.</li><li id="en-us_cts_01_0001__li8120135513217">In the navigation pane on the left, choose <strong id="en-us_cts_01_0001__b26590559184937">Key Event Notifications</strong>.</li><li id="en-us_cts_01_0001__li423764012244">Click <strong id="en-us_cts_01_0001__b842352706162340">Create Key Event Notification</strong> in the upper right corner of the page. On the displayed page, specify required parameters.</li><li id="en-us_cts_01_0001__li16908374285">Enter a key event notification name in the <strong id="en-us_cts_01_0001__b91691155201215">Basic Information</strong> area.<p id="en-us_cts_01_0001__p471524722814"><strong id="en-us_cts_01_0001__b84235270616337">Notification Name</strong>: Identifies key event notifications. This parameter is mandatory. The value contains a maximum of 64 characters, and only letters, numbers, and underscores (_) are allowed.</p>
</li><li id="en-us_cts_01_0001__li20545144173316">Configure key operations.<div class="p" id="en-us_cts_01_0001__p27693465418"><a name="en-us_cts_01_0001__li20545144173316"></a><a name="li20545144173316"></a>Select <strong id="en-us_cts_01_0001__b842352706164557">Typical</strong>, <strong id="en-us_cts_01_0001__b84235270617358">All</strong>, or <strong id="en-us_cts_01_0001__b84235270616506">Custom</strong> based on your actual requirements:<ul id="en-us_cts_01_0001__ul28485134112442"><li id="en-us_cts_01_0001__li55039618112442"><strong id="en-us_cts_01_0001__b154431857174212">Typical</strong>: This option is suitable for enterprise routine auditing. Notifications will be sent when your specified operations occur, such as creating or deleting core resources of ECS, Virtual Private Cloud (VPC), EVS, or Key Management Service (KMS), and logging in as an Identity and Access Management (IAM) user.</li><li id="en-us_cts_01_0001__li13163617112451"><strong id="en-us_cts_01_0001__b842352706165453">All</strong>: This option is suitable if you have connected CTS to your own audit systems. When <strong id="en-us_cts_01_0001__b12103124858">All</strong> is chosen, you cannot deselect operations because all operations on all cloud services that have connected with CTS will trigger notifications. You are advised to use an SMN topic for which HTTPS is selected.</li><li id="en-us_cts_01_0001__li4534192218363"><strong id="en-us_cts_01_0001__b8423527061706">Custom</strong>: This option is suitable for enterprises that require detection of high-risk, cost-sensitive, service-sensitive, and unauthorized operations. You can connect CTS with your own audit systems for log analysis. Select the operations that will trigger notifications. Up to 1000 operations of 100 services can be added for each notification. For details, see <a href="en-us_topic_0100236045.html">Supported Services and Operation Lists</a>.</li></ul>
</div>
</li><li id="en-us_cts_01_0001__li4336918449">Configure users.<p id="en-us_cts_01_0001__p4885125616538"><a name="en-us_cts_01_0001__li4336918449"></a><a name="li4336918449"></a>Specify users. SMN messages will be sent to subscribers when specified users perform key operations.</p>
<ul id="en-us_cts_01_0001__ul1217943143717"><li id="en-us_cts_01_0001__li16179431153720">If you select <strong id="en-us_cts_01_0001__b156615292549">All users</strong>, SMN will notify subscribers of key operations initiated by all users.</li><li id="en-us_cts_01_0001__li717973114377">If you select <strong id="en-us_cts_01_0001__b29401850185417">Specified users</strong> and specify users, SMN will notify subscribers of key operations initiated by these users. You can configure a maximum of 50 users in 10 user groups. For each notification, you can select multiple users in a same user group.</li></ul>
</li><li id="en-us_cts_01_0001__li201879183492">Configure an SMN topic.<ul id="en-us_cts_01_0001__ul934162512138"><li id="en-us_cts_01_0001__li15357611151314">If you select <strong id="en-us_cts_01_0001__b340317181119">Yes</strong> for <strong id="en-us_cts_01_0001__b1640341813116">Send Notification</strong>, you can select an existing topic or click <strong id="en-us_cts_01_0001__b640314181611">Topic</strong> to create one on the SMN console.</li><li id="en-us_cts_01_0001__li193414251136">If you select <strong id="en-us_cts_01_0001__b46316299232932">No</strong> for <strong id="en-us_cts_01_0001__b27486070132932">Send Notification</strong>, no further action is required.</li></ul>
</li><li id="en-us_cts_01_0001__li335715114138">Click <strong id="en-us_cts_01_0001__b1817396162714">Create Now</strong>. The <strong id="en-us_cts_01_0001__b1786217113282">Key Event Notifications</strong> page is displayed, showing all created key event notifications.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030581457.html">Getting Started</a></div>
</div>
</div>

192
docs/cts/umn/en-us_cts_01_0002.html Normal file
View File

File diff suppressed because it is too large Load Diff

185
docs/cts/umn/en-us_cts_03_0011.html Normal file
View File

File diff suppressed because it is too large Load Diff

15
docs/cts/umn/en-us_cts_03_0012.html Normal file
View File

@ -0,0 +1,15 @@
<a name="en-us_cts_03_0012"></a><a name="en-us_cts_03_0012"></a>
<h1 class="topictitle1">Enterprise Intelligence</h1>
<div id="body0000001392850745"></div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="en-us_cts_03_0013.html">Key Operations on ModelArts</a></strong><br>
</li>
</ul>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0100236045.html">Supported Services and Operation Lists</a></div>
</div>
</div>

419
docs/cts/umn/en-us_cts_03_0013.html Normal file
View File

File diff suppressed because it is too large Load Diff

BIN
docs/cts/umn/en-us_image_0000001381965089.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 16 KiB

BIN
docs/cts/umn/en-us_image_0168422564.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/cts/umn/en-us_image_0237950263.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 50 KiB

BIN
docs/cts/umn/en-us_image_0237950264.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 30 KiB

BIN
docs/cts/umn/en-us_image_0237950265.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 671 B

BIN
docs/cts/umn/en-us_image_0237950266.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/cts/umn/en-us_image_0237950267.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 7.6 KiB

BIN
docs/cts/umn/en-us_image_0237964513.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/cts/umn/en-us_image_0237964518.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 391 B

BIN
docs/cts/umn/en-us_image_0238416168.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 19 KiB

122
docs/cts/umn/en-us_topic_0000001317721642.html Normal file
View File

File diff suppressed because it is too large Load Diff

17
docs/cts/umn/en-us_topic_0030579718.html Normal file
View File

@ -0,0 +1,17 @@
<a name="en-us_topic_0030579718"></a><a name="en-us_topic_0030579718"></a>
<h1 class="topictitle1">Overview</h1>
<div id="body39451090"></div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="en-us_topic_0043877274.html">Concepts</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0043877299.html">Working Principle</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0043877300.html">Application Scenarios</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0100236044.html">Supported Services</a></strong><br>
</li>
</ul>
</div>

17
docs/cts/umn/en-us_topic_0030581457.html Normal file
View File

@ -0,0 +1,17 @@
<a name="en-us_topic_0030581457"></a><a name="en-us_topic_0030581457"></a>
<h1 class="topictitle1">Getting Started</h1>
<div id="body1463402907172"></div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="en-us_topic_0030598498.html">Enabling CTS</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0030598499.html">Querying Traces on the CTS Console</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0030598636.html">Querying Archived Traces</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_cts_01_0001.html">Configuring Key Event Notifications</a></strong><br>
</li>
</ul>
</div>

13
docs/cts/umn/en-us_topic_0030581459.html Normal file
View File

@ -0,0 +1,13 @@
<a name="en-us_topic_0030581459"></a><a name="en-us_topic_0030581459"></a>
<h1 class="topictitle1">Trace References</h1>
<div id="body1463402907172"></div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="en-us_topic_0030598500.html">Trace Structure</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0044019595.html">Example Traces</a></strong><br>
</li>
</ul>
</div>

14
docs/cts/umn/en-us_topic_0030594187.html Normal file
View File

@ -0,0 +1,14 @@
<a name="en-us_topic_0030594187"></a><a name="en-us_topic_0030594187"></a>
<h1 class="topictitle1">CTS</h1>
<div id="body1463452513085"><p id="en-us_topic_0030594187__p13920253112619">Log audit is core to information security audit. It is an essential part of security risk control for information systems in enterprises and public sectors. As more information systems are migrating to the cloud, standards on information security have been released around the globe, such as ISO/IEC 27000, GB/T 20945-2013, ITIL, and NIST SP 800.</p>
<p id="en-us_topic_0030594187__p58173419112619">Cloud Trace Service (CTS) is a log audit service for cloud security. It allows you to collect, store, and query resource operation records. You can use these records to perform security analysis, track resource changes, audit compliance, and locate faults.</p>
<div class="p" id="en-us_topic_0030594187__p11853229112637">CTS provides the following functions:<ul id="en-us_topic_0030594187__ul39570199112637"><li id="en-us_topic_0030594187__li20587478112637">Operation recording: CTS records action taken on the console, API calls, and system-triggered actions.</li><li id="en-us_topic_0030594187__li51069578112637">Trace query: You can query traces of the last seven days on the CTS console by multiple filters, such as trace source, resource type, operator, and trace status.</li><li id="en-us_topic_0030594187__li56973020112637">Trace transfer: traces can be transferred to Object Storage Service (OBS) buckets periodically. During transfer, traces are compressed into trace files by service.</li></ul>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0043877274.html">Concepts</a></div>
</div>
</div>

46
docs/cts/umn/en-us_topic_0030598498.html Normal file
View File

@ -0,0 +1,46 @@
<a name="en-us_topic_0030598498"></a><a name="en-us_topic_0030598498"></a>
<h1 class="topictitle1">Enabling CTS</h1>
<div id="body1463455869466"><div class="section" id="en-us_topic_0030598498__section60206522184734"><h4 class="sectiontitle">Scenarios</h4><p id="en-us_topic_0030598498__p2424781410645">You need to enable CTS before using it. A tracker is automatically created when CTS is enabled. All traces recorded by CTS are associated with the tracker. Currently, only one tracker is available in a project for a tenant.</p>
<p id="en-us_topic_0030598498__p5654880152520">Trace files must be stored in OBS buckets. Therefore, before enabling CTS, you must enable OBS and have full permissions of the OBS bucket you are going to use. By default, only the owner who has enabled OBS can access OBS buckets and all objects contained, but the owner can grant permissions to other services and users by configuring an access policy.</p>
<p id="en-us_topic_0030598498__p10661193181535">A tracker created in a multi-project scenario can only track resources under the current project. If tracking cloud resources under another project is required, you need to create a tracker under the project.</p>
<p id="en-us_topic_0030598498__p3806222294436">This section describes how to enable CTS.</p>
</div>
<div class="section" id="en-us_topic_0030598498__section34518472181112"><h4 class="sectiontitle">Prerequisites</h4><p id="en-us_topic_0030598498__p1111499152536">You have created an OBS bucket and have the required permissions.</p>
</div>
<div class="section" id="en-us_topic_0030598498__section5355633918486"><h4 class="sectiontitle">Procedure</h4><ol id="en-us_topic_0030598498__ol510016169458"><li id="en-us_topic_0030598498__li530093789458">Log in to the management console.</li><li id="en-us_topic_0030598498__li1791134612911">Click <span><img id="en-us_topic_0030598498__image6881193535819" src="en-us_image_0237950266.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0030598498__li28269235151120">Click <strong id="en-us_topic_0030598498__b7759810165523">Service List</strong> and choose <strong id="en-us_topic_0030598498__b27915033165530">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0030598498__b842352706152442">Cloud Trace Service</strong>.</li><li id="en-us_topic_0030598498__li410790839458">Click <strong id="en-us_topic_0030598498__b842352706154416">Tracker</strong> in the left navigation pane.</li><li id="en-us_topic_0030598498__li225657719458">Click <strong id="en-us_topic_0030598498__b63204267165446">Enable CTS</strong>.</li><li id="en-us_topic_0030598498__li789842294522">Click <strong id="en-us_topic_0030598498__b1887611189412">Configure</strong> in the <strong id="en-us_topic_0030598498__b842352706142053">Operation</strong> column to set <strong id="en-us_topic_0030598498__b84235270685111">OBS Bucket</strong> and <strong id="en-us_topic_0030598498__b84235270685121">File Prefix</strong>. <a href="#en-us_topic_0030598498__table1478957894650">Table 1</a> lists the parameters.
<div class="tablenoborder"><a name="en-us_topic_0030598498__table1478957894650"></a><a name="table1478957894650"></a><table cellpadding="4" cellspacing="0" summary="" id="en-us_topic_0030598498__table1478957894650" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Parameter description</caption><thead align="left"><tr id="en-us_topic_0030598498__row6408293094650"><th align="left" class="cellrowborder" valign="top" width="14.78%" id="mcps1.3.3.2.6.6.2.4.1.1"><p id="en-us_topic_0030598498__p4996144794718"><strong id="en-us_topic_0030598498__b1866069292432">Parameter</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="60.86%" id="mcps1.3.3.2.6.6.2.4.1.2"><p id="en-us_topic_0030598498__p4035852094718"><strong id="en-us_topic_0030598498__b5868369292435">Description</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="24.36%" id="mcps1.3.3.2.6.6.2.4.1.3"><p id="en-us_topic_0030598498__p2308153794718"><strong id="en-us_topic_0030598498__b4151105892439">Example Value</strong></p>
</th>
</tr>
</thead>
<tbody><tr id="en-us_topic_0030598498__row1446027994650"><td class="cellrowborder" valign="top" width="14.78%" headers="mcps1.3.3.2.6.6.2.4.1.1 "><p id="en-us_topic_0030598498__p4016463094718">OBS Bucket</p>
</td>
<td class="cellrowborder" valign="top" width="60.86%" headers="mcps1.3.3.2.6.6.2.4.1.2 "><p id="en-us_topic_0030598498__p5554085894718">Name of the OBS bucket in which trace files are to be stored.</p>
</td>
<td class="cellrowborder" valign="top" width="24.36%" headers="mcps1.3.3.2.6.6.2.4.1.3 "><p id="en-us_topic_0030598498__p4808477794718">bucket-001</p>
</td>
</tr>
<tr id="en-us_topic_0030598498__row5870890594650"><td class="cellrowborder" valign="top" width="14.78%" headers="mcps1.3.3.2.6.6.2.4.1.1 "><p id="en-us_topic_0030598498__p1284746311350">File Prefix</p>
</td>
<td class="cellrowborder" valign="top" width="60.86%" headers="mcps1.3.3.2.6.6.2.4.1.2 "><p id="en-us_topic_0030598498__p1834979194718">Used for identifying the trace files stored in the OBS bucket. This parameter is optional. The value can contain 0 to 64 characters. Only letters, numbers, hyphens (-), underscores (_), and periods (.) are supported. If a tracker is created, a value will be generated automatically in the same way as you specify the value manually.</p>
</td>
<td class="cellrowborder" valign="top" width="24.36%" headers="mcps1.3.3.2.6.6.2.4.1.3 "><p id="en-us_topic_0030598498__p332119161140">None</p>
</td>
</tr>
</tbody>
</table>
</div>
</li><li id="en-us_topic_0030598498__li5391583817142">Click <strong id="en-us_topic_0030598498__b84235270619330">OK</strong>.</li></ol>
<p id="en-us_topic_0030598498__p16947979171336">After CTS is enabled, you can view details of the created tracker on the <strong id="en-us_topic_0030598498__b6660202892514">Tracker</strong> page.</p>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030581457.html">Getting Started</a></div>
</div>
</div>

26
docs/cts/umn/en-us_topic_0030598499.html Normal file
View File

@ -0,0 +1,26 @@
<a name="en-us_topic_0030598499"></a><a name="en-us_topic_0030598499"></a>
<h1 class="topictitle1">Querying Traces on the CTS Console</h1>
<div id="body1463455869466"><div class="section" id="en-us_topic_0030598499__section5470822195238"><h4 class="sectiontitle">Scenarios</h4><p id="en-us_topic_0030598499__p333055219577">When you enable CTS, the system starts recording operations on cloud resources. Operation records of the last seven days are stored on the CTS console.</p>
<p id="en-us_topic_0030598499__p3008599195238">This section describes how to query or export operation records of the last seven days on the CTS console.</p>
</div>
<div class="section" id="en-us_topic_0030598499__section6300091795238"><h4 class="sectiontitle">Procedure</h4><ol id="en-us_topic_0030598499__ol3001478295238"><li id="en-us_topic_0030598499__li3954991595238">Log in to the management console.</li><li id="en-us_topic_0030598499__li34647912162648">Click <span><img id="en-us_topic_0030598499__image10750445548" src="en-us_image_0237950266.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0030598499__li3694304795238">Click <strong id="en-us_topic_0030598499__b7759810165523">Service List</strong> and choose <strong id="en-us_topic_0030598499__b27915033165530">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0030598499__b842352706152442">Cloud Trace Service</strong>.</li><li id="en-us_topic_0030598499__li4560416895238">Choose <strong id="en-us_topic_0030598499__b199332378711">Trace List</strong> in the navigation pane on the left.</li><li id="en-us_topic_0030598499__li877858395238">Set filters to search for desired traces. The following filters are available:<ul class="subitemlist" id="en-us_topic_0030598499__ul1621413136275"><li id="en-us_topic_0030598499__li1621431318272"><strong id="en-us_topic_0030598499__b84235270615318">Trace Source</strong>, <strong id="en-us_topic_0030598499__b842352706153112">Resource Type</strong>, and <strong id="en-us_topic_0030598499__b842352706153114">Search By</strong>.<p id="en-us_topic_0030598499__p1321481314275">Select the desired content from the drop-down lists one by one.</p>
<p id="en-us_topic_0030598499__p2214131372711">When you select <strong id="en-us_topic_0030598499__b842352706153249">Trace name</strong> for <strong id="en-us_topic_0030598499__b1803301537153246">Search By</strong>, you need to select a trace name.</p>
<p id="en-us_topic_0030598499__p6214181312275">When you select <strong id="en-us_topic_0030598499__b1369790384153349">Resource ID</strong> for <strong id="en-us_topic_0030598499__b1590770393153349">Search By</strong>, you need to enter a resource ID.</p>
<p id="en-us_topic_0030598499__p1121417137276">When you select <strong id="en-us_topic_0030598499__b565110228153447">Resource name</strong>, you also need to select or enter a resource name.</p>
<div class="note" id="en-us_topic_0030598499__note20851112513191"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="en-us_topic_0030598499__p68525254196">Options are available in the <strong id="en-us_topic_0030598499__b7412183520920">Search By</strong> drop-down list only when <strong id="en-us_topic_0030598499__b1982981318919">Trace Source</strong> and <strong id="en-us_topic_0030598499__b79581517290">Resource Type</strong> are specified.</p>
</div></div>
</li><li id="en-us_topic_0030598499__li14214513152714"><strong id="en-us_topic_0030598499__b146002030363">Operator</strong>: Select a user.</li><li id="en-us_topic_0030598499__li22141413122710"><strong id="en-us_topic_0030598499__b361720541664">Trace Status</strong>: Select <strong id="en-us_topic_0030598499__b15617155412610">All trace statuses</strong>, <strong id="en-us_topic_0030598499__b9617754763">normal</strong>, <strong id="en-us_topic_0030598499__b206178544611">warning</strong>, or <strong id="en-us_topic_0030598499__b126171754668">incident</strong>.</li><li id="en-us_topic_0030598499__li13214101362717">In the upper right corner, choose <strong id="en-us_topic_0030598499__b106801718161415">Last 1 hour</strong>, <strong id="en-us_topic_0030598499__b11684171812146">Last 1 day</strong>, or <strong id="en-us_topic_0030598499__b1684218181410">Last 1 week</strong>, or specify a custom time range.</li></ul>
</li><li id="en-us_topic_0030598499__li680921415300">On the right of the filter box, click <strong id="en-us_topic_0030598499__b115965713436">Export</strong>. CTS exports a CSV file listing query results.</li><li id="en-us_topic_0030598499__li944262995238">Click <span><img id="en-us_topic_0030598499__image81252054113416" src="en-us_image_0237950265.png"></span> on the left of the required trace to expand its details.<div class="fignone" id="en-us_topic_0030598499__fig60616999161744"><span class="figcap"><b>Figure 1 </b>Expanded trace details</span><br><span><img id="en-us_topic_0030598499__image751513561119" src="en-us_image_0238416168.png"></span></div>
<p id="en-us_topic_0030598499__p14282752514"></p>
</li><li id="en-us_topic_0030598499__li344192371514">Click <strong id="en-us_topic_0030598499__b193278264449">View Trace</strong> in the <strong id="en-us_topic_0030598499__b768284564414">Operation</strong> column. In the <strong id="en-us_topic_0030598499__b427285094416">View Trace</strong> dialog box, the trace structure details are displayed.<div class="fignone" id="en-us_topic_0030598499__fig2166141610333"><span class="figcap"><b>Figure 2 </b>Viewing a trace</span><br><span><img id="en-us_topic_0030598499__image16866144522817" src="en-us_image_0237950264.png"></span></div>
<p id="en-us_topic_0030598499__p1669615511810">For details on key fields in traces, see <a href="en-us_topic_0030598500.html">Trace Structure</a> and <a href="en-us_topic_0044019595.html">Example Traces</a>.</p>
</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030581457.html">Getting Started</a></div>
</div>
</div>

224
docs/cts/umn/en-us_topic_0030598500.html Normal file
View File

File diff suppressed because it is too large Load Diff

28
docs/cts/umn/en-us_topic_0030598636.html Normal file
View File

@ -0,0 +1,28 @@
<a name="en-us_topic_0030598636"></a><a name="en-us_topic_0030598636"></a>
<h1 class="topictitle1">Querying Archived Traces</h1>
<div id="body1463455979801"><div class="section" id="en-us_topic_0030598636__section1534311495828"><h4 class="sectiontitle">Scenarios</h4><p id="en-us_topic_0030598636__p1901988917341">CTS periodically compresses recorded traces into trace files and delivers them to OBS buckets. A trace file is a collection of traces. CTS generates trace files based on services and transfer periods. If there are a large number of traces, the system will adjust the number of traces contained in each trace file as needed.</p>
<p id="en-us_topic_0030598636__p2525842395828">This section describes how to obtain historical operation records from the trace files downloaded from OBS buckets.</p>
</div>
<div class="section" id="en-us_topic_0030598636__section4763421295828"><h4 class="sectiontitle">Procedure</h4><ol id="en-us_topic_0030598636__ol2707562395828"><li id="en-us_topic_0030598636__li618917495828">Log in to the management console.</li><li id="en-us_topic_0030598636__li8106922428">Click <span><img id="en-us_topic_0030598636__image17544114220111" src="en-us_image_0237950266.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0030598636__li5346313795828">Click <strong id="en-us_topic_0030598636__b2050713910540">Service List</strong> and choose <strong id="en-us_topic_0030598636__b20508189145410">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0030598636__b55094915549">Cloud Trace Service</strong>.</li><li id="en-us_topic_0030598636__li3441308995828">Choose <strong id="en-us_topic_0030598636__b2022954521">Tracker List</strong> in the left navigation pane.</li><li id="en-us_topic_0030598636__li18723135162415">Click an OBS bucket name in the <strong id="en-us_topic_0030598636__b1115812212818">OBS Bucket</strong> column. You will be redirected to the bucket's details page on the OBS console.<div class="p" id="en-us_topic_0030598636__p20610934152518"><div class="fignone" id="en-us_topic_0030598636__fig25931383105014"><span class="figcap"><b>Figure 1 </b>Selecting an OBS bucket</span><br><span><img id="en-us_topic_0030598636__image1012115119358" src="en-us_image_0237950267.png"></span></div>
</div>
<p id="en-us_topic_0030598636__p106847526380"></p>
</li><li id="en-us_topic_0030598636__li5554945111133">Select the target trace by choosing in sequence an OBS bucket, the <strong id="en-us_topic_0030598636__b154124831319">CloudTraces</strong> directory, a region, a year, a month, a day, a tracker name, and a service directory. Click <strong id="en-us_topic_0030598636__b1160335141312">Download</strong> in the <strong id="en-us_topic_0030598636__b19842185331316">Operation</strong> column to download the trace file to the default path. To download the trace file to a customized path, click <strong id="en-us_topic_0030598636__b29461556151317">More</strong> &gt; <strong id="en-us_topic_0030598636__b1120813061413">Download As</strong>.<ul id="en-us_topic_0030598636__ul148190001162"><li id="en-us_topic_0030598636__li279919171162">The trace file storage path is as follows:<p id="en-us_topic_0030598636__p47428456155727"><a name="en-us_topic_0030598636__li279919171162"></a><a name="li279919171162"></a><em id="en-us_topic_0030598636__i17243566145">OBS bucket name</em> &gt; <strong id="en-us_topic_0030598636__b7219165115142">CloudTraces</strong><strong id="en-us_topic_0030598636__b17979859121420"> &gt; </strong><em id="en-us_topic_0030598636__i1251417319159">Region</em> &gt; <em id="en-us_topic_0030598636__i1764212681512">Year</em> &gt; <em id="en-us_topic_0030598636__i13797149171516">Month</em> &gt; <em id="en-us_topic_0030598636__i1276211331510">Day</em> &gt; <em id="en-us_topic_0030598636__i43151818151511">Tracker name</em> &gt; <em id="en-us_topic_0030598636__i4693121131519">Service directory</em></p>
<p id="en-us_topic_0030598636__p4663776495828">An example is <em id="en-us_topic_0030598636__i1331732214162">User-defined name</em><strong id="en-us_topic_0030598636__b14546104841710"> &gt; CloudTraces &gt; region &gt; 2016 &gt; 5 &gt; 19 &gt; system &gt; ECS</strong>.</p>
</li></ul>
<ul id="en-us_topic_0030598636__ul342885641165"><li id="en-us_topic_0030598636__li529846131165">The trace file naming format is as follows:<p id="en-us_topic_0030598636__p1621688895828"><a name="en-us_topic_0030598636__li529846131165"></a><a name="li529846131165"></a><em id="en-us_topic_0030598636__i35450369151612">Trace file prefix</em><strong id="en-us_topic_0030598636__b1615984591811">_CloudTrace_</strong><em id="en-us_topic_0030598636__i39064811152143">Region</em><em id="en-us_topic_0030598636__i842352697102935">/Region-project</em>_<em id="en-us_topic_0030598636__i842352697102959">Time when the trace file was uploaded to OBS</em><em id="en-us_topic_0030598636__i6406556151612">: Year-</em><em id="en-us_topic_0030598636__i57659004151612">Month-</em><em id="en-us_topic_0030598636__i49168993151612">Day</em><strong id="en-us_topic_0030598636__b375364774520">T</strong><em id="en-us_topic_0030598636__i32015893102750">Hour-Minute-Second</em><strong id="en-us_topic_0030598636__b36482149588">Z</strong>_<em id="en-us_topic_0030598636__i6282872215223">Character randomly generated</em><strong id="en-us_topic_0030598636__b18753547114516">.json.gz</strong></p>
<p id="en-us_topic_0030598636__p577818395828">Example: <em id="en-us_topic_0030598636__i118458686816950">File Prefix</em><strong id="en-us_topic_0030598636__b143506570516950">_CloudTrace_region_2016-05-30T16-20-56Z_21d36ced8c8af71e.json.gz</strong></p>
</li></ul>
<div class="note" id="en-us_topic_0030598636__note4679381511655"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="en-us_topic_0030598636__p564014491176">The OBS bucket name and trace file prefix are customized and other parameters are automatically generated.</p>
</div></div>
<p id="en-us_topic_0030598636__p5420789216379">For details on key fields in traces, see <a href="en-us_topic_0030598500.html">Trace Structure</a> and <a href="en-us_topic_0044019595.html">Example Traces</a>.</p>
<div class="fignone" id="en-us_topic_0030598636__fig3440489620918"><span class="figcap"><b>Figure 2 </b>Viewing a trace file</span><br><span><img id="en-us_topic_0030598636__image17529121917374" src="en-us_image_0237950263.png"></span></div>
</li><li id="en-us_topic_0030598636__li60299728173928">Decompress the downloaded package to obtain a JSON file with the same name as the package. Open the JSON file using a text file editor to view traces.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030581457.html">Getting Started</a></div>
</div>
</div>

14
docs/cts/umn/en-us_topic_0030628003.html Normal file
View File

@ -0,0 +1,14 @@
<a name="en-us_topic_0030628003"></a><a name="en-us_topic_0030628003"></a>
<h1 class="topictitle1">Managing a Tracker</h1>
<div id="body1463482006605"><p id="en-us_topic_0030628003__p54701448201616">A tracker is used to record management traces, which are logs of operations on all cloud resources, such as creation, login, and deletion. When you enable CTS, a tracker is created automatically.</p>
</div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="en-us_topic_0059288681.html">Configuring a Tracker</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0030930181.html">Disabling or Enabling a Tracker</a></strong><br>
</li>
</ul>
</div>

18
docs/cts/umn/en-us_topic_0030930181.html Normal file
View File

@ -0,0 +1,18 @@
<a name="en-us_topic_0030930181"></a><a name="en-us_topic_0030930181"></a>
<h1 class="topictitle1">Disabling or Enabling a Tracker</h1>
<div id="body1464052331486"><div class="section" id="en-us_topic_0030930181__section344954110552"><h4 class="sectiontitle">Scenarios</h4><p id="en-us_topic_0030930181__p60695182185319">This section describes how to disable or enable a tracker on the CTS console. After a tracker is disabled, it will stop recording operations, but you can still view operation records that have been collected.</p>
<p id="en-us_topic_0030930181__p3210011510552">This section describes how to disable or enable a tracker.</p>
</div>
<div class="section" id="en-us_topic_0030930181__section2610789710552"><h4 class="sectiontitle">Prerequisites</h4><p id="en-us_topic_0030930181__p4242985510552">You have created a tracker on the CTS console.</p>
</div>
<div class="section" id="en-us_topic_0030930181__section3447669010552"><h4 class="sectiontitle">Procedure</h4><ol id="en-us_topic_0030930181__ol4553303910552"><li id="en-us_topic_0030930181__li3285461910552">Log in to the management console.</li><li id="en-us_topic_0030930181__li1257171918614">Click <span><img id="en-us_topic_0030930181__image122457562139" src="en-us_image_0237950266.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0030930181__li1282117610552">Click <strong id="en-us_topic_0030930181__b225313326216">Service List</strong> and choose <strong id="en-us_topic_0030930181__b925533252112">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0030930181__b92561532172110">Cloud Trace Service</strong>.</li><li id="en-us_topic_0030930181__li1534345110552">Click <strong id="en-us_topic_0030930181__b2477203317">Tracker</strong> in the left navigation pane.</li><li id="en-us_topic_0030930181__li2176469810552">Click <strong id="en-us_topic_0030930181__b1495533203511">Disable</strong> in the same row as the target tracker in the <strong id="en-us_topic_0030930181__b79551537355">Operation</strong> column.</li><li id="en-us_topic_0030930181__li2146126110552">Click <strong id="en-us_topic_0030930181__b842352706161218">Yes</strong>.<p id="en-us_topic_0030930181__p1473718401391">After the tracker is disabled, the <strong id="en-us_topic_0030930181__b777804593619">Disable</strong> button changes to <strong id="en-us_topic_0030930181__b20150174919361">Enable</strong>. To enable the tracker, click <strong id="en-us_topic_0030930181__b1596656141114">Enable</strong> and then click <strong id="en-us_topic_0030930181__b27185880141134">Yes</strong>. The tracker will start recording operations again.</p>
</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0030628003.html">Managing a Tracker</a></div>
</div>
</div>

39
docs/cts/umn/en-us_topic_0030932518.html Normal file
View File

@ -0,0 +1,39 @@
<a name="en-us_topic_0030932518"></a><a name="en-us_topic_0030932518"></a>
<h1 class="topictitle1">FAQs</h1>
<div id="body1464057168910"></div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="cts_faq_001.html">Can I Create Multiple Trackers?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_002.html">Which Type of Information Is Displayed on the Trace List?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_003.html">Can I Delete Traces from the Trace List?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_005.html">What Are the Recommended Users of CTS?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_006.html">How Long Can Trace Files Be Retained?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_007.html">What Will Happen If I Have Enabled CTS But Have Not Configured a Correct Policy for the OBS Bucket?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_009.html">Will Performance of Other Cloud Service Resources Be Affected If I Enable CTS?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_010.html">Why Are Fields of Some Traces Displayed as Null on the View Trace Page?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_011.html">Why Are the Resource IDs of Some Traces in the Trace List Hyperlinks?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_012.html">Why Is an Operation Recorded Twice in the Trace List?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_013.html">Why Are user_name and op_service Displayed When I Filter Traces by User?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_015.html">What Services Are Supported for Key Event Notification?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_017.html">Which Type of OBS Buckets Is Suitable for CTS to Store Traces?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_019.html">Why Are user and source_ip Empty for Some Traces with trace_type as systemAction?</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="cts_faq_020.html">What Are the Meanings of the Three Trace Statuses?</a></strong><br>
</li>
</ul>
</div>

15
docs/cts/umn/en-us_topic_0043371376.html Normal file
View File

@ -0,0 +1,15 @@
<a name="en-us_topic_0043371376"></a><a name="en-us_topic_0043371376"></a>
<h1 class="topictitle1">Application Examples</h1>
<div id="body1480585937280"></div>
<div>
<ul class="ullinks">
<li class="ulchildlink"><strong><a href="en-us_topic_0043371377.html">Security Auditing</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0043371379.html">Fault Locating</a></strong><br>
</li>
<li class="ulchildlink"><strong><a href="en-us_topic_0043371378.html">Resource Tracking</a></strong><br>
</li>
</ul>
</div>

19
docs/cts/umn/en-us_topic_0043371377.html Normal file
View File

@ -0,0 +1,19 @@
<a name="en-us_topic_0043371377"></a><a name="en-us_topic_0043371377"></a>
<h1 class="topictitle1">Security Auditing</h1>
<div id="body1480585937280"><div class="section" id="en-us_topic_0043371377__section29070389181456"><h4 class="sectiontitle">Scenarios</h4><p id="en-us_topic_0043371377__p19353273181544">You can query operation records matching specified conditions and check whether operations have been performed by authorized users for security analysis.</p>
</div>
<div class="section" id="en-us_topic_0043371377__section15151415181756"><h4 class="sectiontitle">Prerequisites</h4><p id="en-us_topic_0043371377__p21358571163833">You have enabled CTS and the tracker is running properly. For details on how to enable CTS, see <a href="en-us_topic_0030598498.html">Enabling CTS</a>.</p>
</div>
<div class="section" id="en-us_topic_0043371377__section48879286181857"><h4 class="sectiontitle">Procedure</h4><p id="en-us_topic_0043371377__p39460202181942">The following shows how you can review records of EVS disk creation and deletion over the last two weeks.</p>
<ol id="en-us_topic_0043371377__ol22040361181932"><li id="en-us_topic_0043371377__li49796966181949">Log in to the management console as an administrator.</li><li id="en-us_topic_0043371377__li924912581389">Click <span><img id="en-us_topic_0043371377__image175292047163016" src="en-us_image_0168422564.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0043371377__li1394586618202">Click <strong id="en-us_topic_0043371377__b842352706104116">Service List</strong> and choose <strong id="en-us_topic_0043371377__b842352706152451">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0043371377__b842352706183814">Cloud Trace Service</strong>.</li><li id="en-us_topic_0043371377__li5286401318204">Choose <strong id="en-us_topic_0043371377__b42162954165740">Trace List</strong> in the navigation pane on the left.</li><li id="en-us_topic_0043371377__li857921015615"><a name="en-us_topic_0043371377__li857921015615"></a><a name="li857921015615"></a>Set filters in sequence: <strong id="en-us_topic_0043371377__b1981217481632">Trace Source</strong> &gt; <strong id="en-us_topic_0043371377__b1181213481332">Resource Type</strong> &gt; <strong id="en-us_topic_0043371377__b10812124818318">Search By</strong> &gt; <strong id="en-us_topic_0043371377__b89218559115">Operator</strong> &gt; <strong id="en-us_topic_0043371377__b122181457611">Trace Status</strong>. Then click <strong id="en-us_topic_0043371377__b13812134820311">Query</strong> to view the result.<div class="note" id="en-us_topic_0043371377__note69614171367"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="en-us_topic_0043371377__p1925811411518">Select <strong id="en-us_topic_0043371377__b166721393411">evs</strong> for <strong id="en-us_topic_0043371377__b186721591944">Trace Source</strong>, <strong id="en-us_topic_0043371377__b156721491146">evs</strong> for <strong id="en-us_topic_0043371377__b15672391149">Resource Type</strong>, <strong id="en-us_topic_0043371377__b567212919411">Trace name</strong> for <strong id="en-us_topic_0043371377__b5672598412">Search By</strong>, and select <strong id="en-us_topic_0043371377__b86721298410">createVolume</strong> or <strong id="en-us_topic_0043371377__b6672119644">deleteVolume</strong>. Then, click <strong id="en-us_topic_0043371377__b166721699419">Query</strong> to search for all EVS creation or deletion operations of the last seven days.</p>
</div></div>
</li><li id="en-us_topic_0043371377__li64792700182010">Choose <strong id="en-us_topic_0043371377__b1647827584165843">Tracker</strong> in the left navigation pane to obtain an OBS bucket name.</li><li id="en-us_topic_0043371377__li26706607152621">Download traces older than seven days or all traces by following the instructions in <a href="en-us_topic_0030598636.html">Querying Archived Traces</a>.</li><li id="en-us_topic_0043371377__li38255771182015"><a name="en-us_topic_0043371377__li38255771182015"></a><a name="li38255771182015"></a>In the downloaded file, locate required operation records by searching for keywords <strong id="en-us_topic_0043371377__b76281635451">createVolume</strong> and <strong id="en-us_topic_0043371377__b86286359516">deleteVolume</strong>.</li><li id="en-us_topic_0043371377__li22997390182020">Check the traces obtained in steps <a href="#en-us_topic_0043371377__li857921015615">5</a> and <a href="#en-us_topic_0043371377__li38255771182015">8</a> to see whether there are any unauthorized operations or operations that do not conform to security rules.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0043371376.html">Application Examples</a></div>
</div>
</div>

19
docs/cts/umn/en-us_topic_0043371378.html Normal file
View File

@ -0,0 +1,19 @@
<a name="en-us_topic_0043371378"></a><a name="en-us_topic_0043371378"></a>
<h1 class="topictitle1">Resource Tracking</h1>
<div id="body1480585937281"><div class="section" id="en-us_topic_0043371378__section28509637193319"><h4 class="sectiontitle">Scenarios</h4><p id="en-us_topic_0043371378__p18352529193330">You can view operation records of a cloud resource throughout its lifecycle.</p>
</div>
<div class="section" id="en-us_topic_0043371378__section13625028193339"><h4 class="sectiontitle">Prerequisites</h4><p id="en-us_topic_0043371378__p21358571163833">You have enabled CTS and the tracker is running properly. For details on how to enable CTS, see <a href="en-us_topic_0030598498.html">Enabling CTS</a>.</p>
</div>
<div class="section" id="en-us_topic_0043371378__section727451193431"><h4 class="sectiontitle">Procedure</h4><p id="en-us_topic_0043371378__p3294395193523">The following takes the records of all operations on an ECS as an example.</p>
<ol id="en-us_topic_0043371378__ol45058899193540"><li id="en-us_topic_0043371378__li46788270193540">Log in to the management console as an administrator.</li><li id="en-us_topic_0043371378__li1687580113">Click <span><img id="en-us_topic_0043371378__image285521511362" src="en-us_image_0168422564.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0043371378__li32288751193543">Click <strong id="en-us_topic_0043371378__b842352706104116">Service List</strong> and choose <strong id="en-us_topic_0043371378__b842352706152451">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0043371378__b842352706183814">Cloud Trace Service</strong>.</li><li id="en-us_topic_0043371378__li42427023193548">Choose <strong id="en-us_topic_0043371378__b42162954165740">Trace List</strong> in the navigation pane on the left.</li><li id="en-us_topic_0043371378__li36410601182"><a name="en-us_topic_0043371378__li36410601182"></a><a name="li36410601182"></a>Set filters in sequence: <strong id="en-us_topic_0043371378__b590122118362">Trace Source</strong> &gt; <strong id="en-us_topic_0043371378__b119011521103616">Resource Type</strong> &gt; <strong id="en-us_topic_0043371378__b790182133615">Search By</strong>. Then click <strong id="en-us_topic_0043371378__b590111217360">Query</strong> to view the result.<div class="note" id="en-us_topic_0043371378__note4381420811811"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="en-us_topic_0043371378__p5878355811811">Select <strong id="en-us_topic_0043371378__b1777103815361">ecs</strong> for <strong id="en-us_topic_0043371378__b4771938163619">Trace Source</strong>, <strong id="en-us_topic_0043371378__b10774382363">ecs</strong> for <strong id="en-us_topic_0043371378__b37773815365">Resource Type</strong>, <strong id="en-us_topic_0043371378__b977538113611">Resource ID</strong> for <strong id="en-us_topic_0043371378__b7774387360">Search By</strong>, and enter the ID of the VM. Click <strong id="en-us_topic_0043371378__b82612610014">Query</strong> to obtain the traces generated in the last seven days.</p>
</div></div>
</li><li id="en-us_topic_0043371378__li62831252193553">Choose <strong id="en-us_topic_0043371378__b5958104015315">Tracker</strong> in the left navigation pane to obtain an OBS bucket name.</li><li id="en-us_topic_0043371378__li14173783182013"><a name="en-us_topic_0043371378__li14173783182013"></a><a name="li14173783182013"></a>Download traces older than seven days or all traces by following the instructions in <a href="en-us_topic_0030598636.html">Querying Archived Traces</a>.</li><li id="en-us_topic_0043371378__li2566137193558">Check all the traces obtained in steps <a href="#en-us_topic_0043371378__li36410601182">5</a> and <a href="#en-us_topic_0043371378__li14173783182013">7</a>.</li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0043371376.html">Application Examples</a></div>
</div>
</div>

21
docs/cts/umn/en-us_topic_0043371379.html Normal file
View File

@ -0,0 +1,21 @@
<a name="en-us_topic_0043371379"></a><a name="en-us_topic_0043371379"></a>
<h1 class="topictitle1">Fault Locating</h1>
<div id="body1480585937281"><div class="section" id="en-us_topic_0043371379__section6291060118322"><h4 class="sectiontitle">Scenarios</h4><p id="en-us_topic_0043371379__p41652022183211">If a resource or an action encounters an exception, you can query operation records for the resource or action in a specified time period and view the requests and responses to facilitate troubleshooting.</p>
</div>
<div class="section" id="en-us_topic_0043371379__section2947819183220"><h4 class="sectiontitle">Prerequisites</h4><p id="en-us_topic_0043371379__p21358571163833">You have enabled CTS and the tracker is running properly. For details on how to enable CTS, see <a href="en-us_topic_0030598498.html">Enabling CTS</a>.</p>
</div>
<div class="section" id="en-us_topic_0043371379__section64841869191343"><h4 class="sectiontitle">Procedure</h4><p id="en-us_topic_0043371379__p25971326191548">To locate an ECS fault which occurred in the morning:</p>
<ol id="en-us_topic_0043371379__ol5387276719305"><li id="en-us_topic_0043371379__li5674193619305">Log in to the management console as an administrator.</li><li id="en-us_topic_0043371379__li23041491493">Click <span><img id="en-us_topic_0043371379__image731825183810" src="en-us_image_0237964513.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0043371379__li597108019307">Click <strong id="en-us_topic_0043371379__b842352706104116">Service List</strong> and choose <strong id="en-us_topic_0043371379__b842352706152451">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0043371379__b842352706183814">Cloud Trace Service</strong>.</li><li id="en-us_topic_0043371379__li10568277193011">Choose <strong id="en-us_topic_0043371379__b42162954165740">Trace List</strong> in the navigation pane on the left.</li><li id="en-us_topic_0043371379__li2595642911322">Set filters in sequence: <strong id="en-us_topic_0043371379__b685534218131">Trace Source</strong> &gt; <strong id="en-us_topic_0043371379__b19856642161310">Resource Type</strong> &gt; <strong id="en-us_topic_0043371379__b13856124241316">Search By</strong>. Then click <strong id="en-us_topic_0043371379__b0856184281318">Query</strong> to view the result.<div class="note" id="en-us_topic_0043371379__note4381420811811"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="en-us_topic_0043371379__p5878355811811">Select <strong id="en-us_topic_0043371379__b124301732151917">ecs</strong> for <strong id="en-us_topic_0043371379__b84301832181915">Trace Source</strong>, <strong id="en-us_topic_0043371379__b843016328192">ecs</strong> for <strong id="en-us_topic_0043371379__b3430123291910">Resource Type</strong>, and <strong id="en-us_topic_0043371379__b14301322191">Resource ID</strong> for <strong id="en-us_topic_0043371379__b204306323197">Search By</strong>. Enter the ID of the faulty virtual machine (VM), and select a time range from 06:00:00 to 12:00:00 on the day when the fault occurred in the upper right corner. Then click <strong id="en-us_topic_0043371379__b2043118325198">Query</strong>.</p>
</div></div>
</li><li id="en-us_topic_0043371379__li62204713193022">Check the returned traces, especially the request type and response of each trace. Note any traces whose status is <strong id="en-us_topic_0043371379__b6873844112115">warning</strong> or <strong id="en-us_topic_0043371379__b287384482115">incident</strong>, and any traces whose response indicates a failure.</li></ol>
<div class="p" id="en-us_topic_0043371379__p28269376192959">To locate a fault after an ECS server failed to be created:<ol id="en-us_topic_0043371379__ol60752627193028"><li id="en-us_topic_0043371379__li63924094193028">Log in to the management console as an administrator.</li><li id="en-us_topic_0043371379__li45481443163415">Click <span><img id="en-us_topic_0043371379__image126048218323" src="en-us_image_0237950266.png"></span> in the upper left corner to select the desired project.</li><li id="en-us_topic_0043371379__li35398716193055">Click <strong id="en-us_topic_0043371379__b1886488424">Service List</strong> and choose <strong id="en-us_topic_0043371379__b368327676">Management &amp; Deployment</strong> &gt; <strong id="en-us_topic_0043371379__b1887610374">Cloud Trace Service</strong>.</li><li id="en-us_topic_0043371379__li11485349193058">Choose <strong id="en-us_topic_0043371379__b1552387643">Trace List</strong> in the navigation pane on the left.</li><li id="en-us_topic_0043371379__li51616363141150">Select <strong id="en-us_topic_0043371379__b92921545162711">esc</strong> for <strong id="en-us_topic_0043371379__b9292445142716">Trace Source</strong>, <strong id="en-us_topic_0043371379__b1529214562718">ecs</strong> for <strong id="en-us_topic_0043371379__b10292194532720">Resource Type</strong>, and <strong id="en-us_topic_0043371379__b102921445192712">warning</strong> for <strong id="en-us_topic_0043371379__b16292245172717">Trace Status</strong>. In the returned traces, locate the trace named <strong id="en-us_topic_0043371379__b16292154517278">createSingleServer</strong>.</li><li id="en-us_topic_0043371379__li424729119312">Check the trace details and locate the fault based on the error code or error message.</li></ol>
</div>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0043371376.html">Application Examples</a></div>
</div>
</div>

Some files were not shown because too many files have changed in this diff Show More