Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
# Menanyakan log dengan Wawasan CloudWatch Log
CloudWatch Logs Insights memungkinkan Anda mencari dan menganalisis data log akses server secara interaktif. Kueri dijalankan terhadap grup log tempat log Anda dikirimkan dan mengembalikan hasil dalam hitungan detik.
**catatan**
Untuk menanyakan log yang dikirimkan ke bucket tujuan umum Amazon S3, lihat. [Melakukan kueri pencatatan akses untuk permintaan dengan menggunakan Amazon Athena](using-s3-access-logs-to-identify-requests.md#querying-s3-access-logs-for-requests) Untuk menanyakan cermin Tabel S3 dengan SQL, lihat. [Menanyakan log akses di Tabel S3](sal-cw-querying-s3tables.md)
## Memulai
1. Buka CloudWatch konsol di [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/).
1. Di panel navigasi, pilih **Log**, lalu **Wawasan Log**.
1. Pilih grup log akses server Anda dari pemilih grup log.
1. Pilih rentang waktu untuk kueri Anda.
1. Masukkan kueri dan pilih **Jalankan kueri**.
## Analisis lalu lintas
Kueri berikut membantu Anda memahami volume permintaan dan pola lalu lintas.
**Example Minta volume dari waktu ke waktu**
```
stats count(*) as requests by bin(5m) as interval
| sort interval asc
```
**Example Minta campuran berdasarkan jenis operasi**
```
stats count(*) as cnt by operation
| sort cnt desc
```
**Example Lalu lintas dengan ember**
```
stats count(*) as requests, sum(bytes_sent_size) as bytes_out by bucket_arn
| sort requests desc
```
## Pemecahan masalah kesalahan
Pertanyaan berikut membantu Anda mengidentifikasi dan mendiagnosis kesalahan.
**Example Rincian tingkat kesalahan**
```
filter http_status >= 400
| stats count(*) as error_count by http_status, error_code, operation
| sort error_count desc
```
**Example 403 Akses Permintaan Ditolak**
```
filter http_status = 403
| stats count(*) as denied_count by key_name, remote_ip, requester
| sort denied_count desc
```
**Example 404 Permintaan Tidak Ditemukan**
```
filter http_status = 404
| stats count(*) as miss_count by key_name, error_code, remote_ip
| sort miss_count desc
```
**Example 503 SlowDown (throttling) acara**
```
filter http_status = 503
| stats count(*) as throttle_count by key_name, remote_ip
| sort throttle_count desc
```
## Pola akses
Pertanyaan berikut membantu Anda memahami siapa yang mengakses data Anda dan bagaimana caranya.
**Example Lalu lintas berdasarkan sumber IP**
```
stats count(*) as total_requests,
sum(http_status >= 400) as errors,
sum(bytes_sent_size) as bytes_transferred
by remote_ip
| sort total_requests desc
```
**Example Operasi oleh pemohon**
```
stats count(*) as requests by requester, operation
| sort requests desc
```
**Example Kunci yang paling banyak diakses**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats count(*) as access_count, sum(bytes_sent_size) as bytes_out by key_name
| sort access_count desc
| limit 10
```
## Analisis latensi
Kueri berikut membantu Anda mengidentifikasi permintaan lambat dan tren latensi.
**Example Latensi berdasarkan jenis operasi**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms,
pct(total_duration, 50) as p50_ms,
pct(total_duration, 95) as p95_ms,
max(total_duration) as max_ms,
count(*) as requests
by operation
```
**Example Tombol paling lambat dengan latensi p95**
```
filter operation like /REST\.GET\.OBJECT/
| stats avg(total_duration) as avg_ms,
pct(total_duration, 95) as p95_ms,
count(*) as requests
by key_name
| sort p95_ms desc
| limit 10
```
**Example Latensi dari waktu ke waktu**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms, pct(total_duration, 95) as p95_ms by bin(5m) as interval
| sort interval asc
```
## Atribusi biaya
Pertanyaan berikut membantu Anda memahami transfer data dan mengidentifikasi driver biaya.
**Example Transfer data dengan operasi**
```
filter operation like /REST\.(GET|PUT|DELETE)\.OBJECT/
| stats sum(bytes_sent_size) as total_bytes_out,
sum(object_size) as total_object_bytes,
count(*) as request_count
by operation
| sort total_bytes_out desc
```
**Example Objek terbesar yang dilayani**
```
filter operation like /REST\.GET\.OBJECT/ and bytes_sent_size > 0
| stats max(object_size) as max_size, avg(object_size) as avg_size, count(*) as reads by key_name
| sort max_size desc
| limit 10
```
## Analisis keamanan
Kueri berikut membantu Anda mendeteksi pola akses yang mencurigakan.
**Example IP dengan tingkat kesalahan tinggi**
```
stats count(*) as total,
sum(http_status >= 400) as errors
by remote_ip
| filter errors > 10
| sort errors desc
```
**Example Upaya akses gagal dengan kunci**
```
filter http_status >= 400
| stats count(*) as attempts by remote_ip, key_name, operation, http_status
| sort attempts desc
| limit 20
```
**Example Distribusi versi TLS**
```
stats count(*) as cnt by tls_version
| sort cnt desc
```