Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Menanyakan log dengan Wawasan CloudWatch Log
CloudWatch Logs Insights memungkinkan Anda mencari dan menganalisis data log akses server secara interaktif. Kueri dijalankan terhadap grup log tempat log Anda dikirimkan dan mengembalikan hasil dalam hitungan detik.
catatan
Untuk menanyakan log yang dikirimkan ke bucket tujuan umum Amazon S3, lihat. Melakukan kueri pencatatan akses untuk permintaan dengan menggunakan Amazon Athena Untuk menanyakan cermin Tabel S3 dengan SQL, lihat. Menanyakan log akses di Tabel S3
Memulai
-
Buka CloudWatch konsol di https://console.aws.amazon.com/cloudwatch/
. -
Di panel navigasi, pilih Log, lalu Wawasan Log.
-
Pilih grup log akses server Anda dari pemilih grup log.
-
Pilih rentang waktu untuk kueri Anda.
-
Masukkan kueri dan pilih Jalankan kueri.
Analisis lalu lintas
Kueri berikut membantu Anda memahami volume permintaan dan pola lalu lintas.
contoh Minta volume dari waktu ke waktu
stats count(*) as requests by bin(5m) as interval | sort interval asc
contoh Minta campuran berdasarkan jenis operasi
stats count(*) as cnt by operation | sort cnt desc
contoh Lalu lintas dengan ember
stats count(*) as requests, sum(bytes_sent_size) as bytes_out by bucket_arn | sort requests desc
Pemecahan masalah kesalahan
Pertanyaan berikut membantu Anda mengidentifikasi dan mendiagnosis kesalahan.
contoh Rincian tingkat kesalahan
filter http_status >= 400 | stats count(*) as error_count by http_status, error_code, operation | sort error_count desc
contoh 403 Akses Permintaan Ditolak
filter http_status = 403 | stats count(*) as denied_count by key_name, remote_ip, requester | sort denied_count desc
contoh 404 Permintaan Tidak Ditemukan
filter http_status = 404 | stats count(*) as miss_count by key_name, error_code, remote_ip | sort miss_count desc
contoh 503 SlowDown (throttling) acara
filter http_status = 503 | stats count(*) as throttle_count by key_name, remote_ip | sort throttle_count desc
Pola akses
Pertanyaan berikut membantu Anda memahami siapa yang mengakses data Anda dan bagaimana caranya.
contoh Lalu lintas berdasarkan sumber IP
stats count(*) as total_requests, sum(http_status >= 400) as errors, sum(bytes_sent_size) as bytes_transferred by remote_ip | sort total_requests desc
contoh Operasi oleh pemohon
stats count(*) as requests by requester, operation | sort requests desc
contoh Kunci yang paling banyak diakses
filter operation like /REST\.(GET|PUT)\.OBJECT/ | stats count(*) as access_count, sum(bytes_sent_size) as bytes_out by key_name | sort access_count desc | limit 10
Analisis latensi
Kueri berikut membantu Anda mengidentifikasi permintaan lambat dan tren latensi.
contoh Latensi berdasarkan jenis operasi
filter operation like /REST\.(GET|PUT)\.OBJECT/ | stats avg(total_duration) as avg_ms, pct(total_duration, 50) as p50_ms, pct(total_duration, 95) as p95_ms, max(total_duration) as max_ms, count(*) as requests by operation
contoh Tombol paling lambat dengan latensi p95
filter operation like /REST\.GET\.OBJECT/ | stats avg(total_duration) as avg_ms, pct(total_duration, 95) as p95_ms, count(*) as requests by key_name | sort p95_ms desc | limit 10
contoh Latensi dari waktu ke waktu
filter operation like /REST\.(GET|PUT)\.OBJECT/ | stats avg(total_duration) as avg_ms, pct(total_duration, 95) as p95_ms by bin(5m) as interval | sort interval asc
Atribusi biaya
Pertanyaan berikut membantu Anda memahami transfer data dan mengidentifikasi driver biaya.
contoh Transfer data dengan operasi
filter operation like /REST\.(GET|PUT|DELETE)\.OBJECT/ | stats sum(bytes_sent_size) as total_bytes_out, sum(object_size) as total_object_bytes, count(*) as request_count by operation | sort total_bytes_out desc
contoh Objek terbesar yang dilayani
filter operation like /REST\.GET\.OBJECT/ and bytes_sent_size > 0 | stats max(object_size) as max_size, avg(object_size) as avg_size, count(*) as reads by key_name | sort max_size desc | limit 10
Analisis keamanan
Kueri berikut membantu Anda mendeteksi pola akses yang mencurigakan.
contoh IP dengan tingkat kesalahan tinggi
stats count(*) as total, sum(http_status >= 400) as errors by remote_ip | filter errors > 10 | sort errors desc
contoh Upaya akses gagal dengan kunci
filter http_status >= 400 | stats count(*) as attempts by remote_ip, key_name, operation, http_status | sort attempts desc | limit 20
contoh Distribusi versi TLS
stats count(*) as cnt by tls_version | sort cnt desc
