Shulou(Shulou.com)06/01 Report--

This article mainly shows you "how to use log audit to see what operations MaxCompute has performed", the content is simple and clear, and I hope it can help you solve your doubts. Let me lead you to study and learn this article "how to use log audit to see what operations MaxCompute has performed".

Background

In many data development scenarios, we need to record what each sub-account has done, which project has performed specific operations, and if there is a problem, we need to audit who did it, when, and how. For example, someone maliciously deletes the data, someone downloads the data, who uploads the resources, someone adds permissions to people who don't have permission, and so on. These actions need to be managed and tracked. This article tracks the actions we perform in MaxCompute through how to search the ActionTrail console.

Log audit and Informattion_Schema (metadata) comparison

1. Log audit records the actions of users.

two。 Log audit records all items under the current account, while Informattion_Schema records the current project.

3. If we want to view the user's behavior information, we can check it in the log audit. If we query some static information, we can check the metadata, such as the owner of the table and the owner of the resource.

The TASKS_ history table in 4.Informattion_Schema can record the history of completed jobs, but it is not easy to find without a corresponding event name. For example, to find the delete table, we can go directly to ActionTrail and search DropTable directly to find it.

5.MaxCompute records the user's actions are delivered to ActionTrail in real time, and the operation records are tracked and recorded by the operation audit within 10 minutes. The operation record is saved for 180 days. At present, ActionTrail supports search. If you need to analyze the log more accurately and save it for a longer time, you can send it to oss or this sls to synchronize to MaxCompute for analysis.

6. If we want to count the most expensive assignments of the day, we can check the task_ histoy table in Informattion_Schema.

-- Statistics on the top 10 tasks that consume the most amount of cu in a day select * from information_Schema.TASKS_HISTORY where ds = 20200812 order by cost_cpu limit 10 words-Statistics on the cuselect owner_name,SUM (cost_cpu) from information_Schema.TASKS_HISTORY where ds = 20200814 group by owner_id,owner_name; used by each user in a day how to search using ActionTrail

Let's list a few simple scenarios to search.

First log in to the historical event query page of the ActionTrail console and select the region you want to view.

As shown above, event type: all types, time: select the corresponding time product type: MaxCompute

Check what the sub-account has done.

User name: the name of the sub-account

Find out who killed the current task.

Event name: jobChange Resource name: instanceId (specific task id)

Check what the table has done

Resource name: table name

Check who has read the table

Event name: ReadTableData resource name: table name

To see who deleted the table:

Event name: DropTable resource name: table name

Check who downloaded the table.

Event name: DownloadTable (downloaded directly using tunnel download table name) InstanceTunnel (downloaded via instanceuid) Resource name: table name

Check when the table uploaded data

Event name: UploadTable (including data integration) resource name: table name

View function creation

Event name: CreateFunction resource name: function name

View resource creation events

Event name: CreateResource resource name: resource name

View create roles

Event name: CreateRole resource name: role name

View authorization events

Event name: GrantRole resource name: role name

Where the source_ip field: the native IP is executed through the client or sdk. The execution via DataWorks is not a native IP

Correlation_id field: corresponding instanceid. We can go to the corresponding project execution wait instanceid to check the details of task execution.

The above is all the contents of the article "how to use Log Audit to see what MaxCompute has done". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.