Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
# Menanyakan log akses di Tabel S3
Saat Anda mengaktifkan integrasi Tabel Amazon S3, Amazon CloudWatch Logs mengirimkan log akses server Anda dalam format Apache Iceberg ke bucket tabel terkelola. `aws-cloudwatch` Karena data dalam format Iceberg, Anda dapat menanyakannya dengan alat apa pun yang mendukung Apache Iceberg, termasuk:
+ **Amazon Athena** — Jalankan kueri SQL langsung dari konsol Athena menggunakan katalog Tabel S3.
+ **Amazon SageMaker Unified Studio** — Gunakan editor SQL bawaan untuk menanyakan data log Anda bersama beban kerja analitik lainnya.
+ **Amazon Redshift** — Tabel Query Iceberg melalui Redshift Spectrum atau integrasi langsung.
+ **Apache Spark di Amazon EMR** - Gunakan Spark SQL atau API dengan konektor Iceberg. DataFrame
+ **Open-source alat** - Alat apa pun yang mendukung katalog Apache Iceberg REST, seperti Trino, DuckDB, atau. PyIceberg
**catatan**
Untuk menanyakan log secara interaktif di Wawasan CloudWatch Log (tanpa SQL), lihat. [Menanyakan log dengan Wawasan CloudWatch Log](sal-cw-querying-insights.md)
## Prasyarat
Sebelum Anda dapat meminta log akses di Tabel S3, Anda harus menyelesaikan yang berikut ini:
1. **Aktifkan integrasi Tabel S3.** Lihat [Mengaktifkan integrasi Tabel S3 (opsional)](sal-cw-enabling.md#sal-cw-tables-integration).
1. **Aktifkan integrasi Tabel S3 dengan layanan analitik.** **Di konsol Amazon S3, navigasikan ke **bucket Table** dan pilih Aktifkan integrasi.** Ini membuat katalog `s3tablescatalog` federasi di Katalog Data dan membuat tabel Anda terlihat oleh layanan analitik. Secara default, akses dikontrol melalui izin IAM. Anda dapat secara opsional menggunakan kontrol AWS Lake Formation akses berbutir halus. Untuk informasi selengkapnya, lihat [Mengintegrasikan Tabel S3 dengan layanan AWS analitik](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html).
1. **Tunggu data terisi.** Data biasanya muncul dalam waktu satu jam setelah pengiriman pertama ke CloudWatch Log.
## Menghubungkan Amazon Athena
1. Buka konsol Athena di [https://console.aws.amazon.com/athena/](https://console.aws.amazon.com/athena/).
1. Di editor kueri, pilih katalog **Amazon S3 Tables** dari dropdown sumber data.
1. Tabel log Anda muncul dalam daftar database di bawah `logs` namespace.
Nama tabel untuk log akses server adalah`amazon_s3__server_access`. Referensi tabel yang sepenuhnya memenuhi syarat adalah:
```
"s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
```
## Analisis lalu lintas
**Example Minta volume dari waktu ke waktu**
```
SELECT date_trunc('minute', request_time) AS interval,
COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY date_trunc('minute', request_time)
ORDER BY interval ASC;
```
**Example Minta campuran berdasarkan jenis operasi**
```
SELECT operation, COUNT(*) AS cnt
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY operation
ORDER BY cnt DESC;
```
**Example Lalu lintas dengan ember**
```
SELECT bucket_arn, COUNT(*) AS requests, SUM(bytes_sent_size) AS bytes_out
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY bucket_arn
ORDER BY requests DESC;
```
## Pemecahan masalah kesalahan
**Example Rincian tingkat kesalahan**
```
SELECT http_status, error_code, operation, COUNT(*) AS error_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status >= 400
GROUP BY http_status, error_code, operation
ORDER BY error_count DESC;
```
**Example 403 Akses Permintaan Ditolak**
```
SELECT key_name, remote_ip, requester, COUNT(*) AS denied_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status = 403
GROUP BY key_name, remote_ip, requester
ORDER BY denied_count DESC;
```
**Example 404 Permintaan Tidak Ditemukan**
```
SELECT key_name, error_code, remote_ip, COUNT(*) AS miss_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status = 404
GROUP BY key_name, error_code, remote_ip
ORDER BY miss_count DESC;
```
**Example 503 SlowDown (throttling) acara**
```
SELECT key_name, remote_ip, COUNT(*) AS throttle_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status = 503
GROUP BY key_name, remote_ip
ORDER BY throttle_count DESC;
```
## Pola akses
**Example Lalu lintas berdasarkan sumber IP**
```
SELECT remote_ip,
COUNT(*) AS total_requests,
SUM(CASE WHEN http_status >= 400 THEN 1 ELSE 0 END) AS errors,
SUM(bytes_sent_size) AS bytes_transferred
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY remote_ip
ORDER BY total_requests DESC;
```
**Example Operasi oleh pemohon**
```
SELECT requester, operation, COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY requester, operation
ORDER BY requests DESC;
```
**Example Kunci yang paling banyak diakses**
```
SELECT key_name, COUNT(*) AS access_count, SUM(bytes_sent_size) AS bytes_out
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT')
GROUP BY key_name
ORDER BY access_count DESC
LIMIT 10;
```
## Analisis latensi
**Example Latensi berdasarkan jenis operasi**
```
SELECT operation,
AVG(total_duration) AS avg_ms,
APPROX_PERCENTILE(total_duration, 0.5) AS p50_ms,
APPROX_PERCENTILE(total_duration, 0.95) AS p95_ms,
MAX(total_duration) AS max_ms,
COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT')
GROUP BY operation;
```
**Example Tombol paling lambat dengan latensi p95**
```
SELECT key_name,
AVG(total_duration) AS avg_ms,
APPROX_PERCENTILE(total_duration, 0.95) AS p95_ms,
COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation = 'REST.GET.OBJECT'
GROUP BY key_name
ORDER BY p95_ms DESC
LIMIT 10;
```
**Example Latensi dari waktu ke waktu**
```
SELECT date_trunc('minute', request_time) AS interval,
AVG(total_duration) AS avg_ms,
APPROX_PERCENTILE(total_duration, 0.95) AS p95_ms
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT')
GROUP BY date_trunc('minute', request_time)
ORDER BY interval ASC;
```
## Atribusi biaya
**Example Transfer data dengan operasi**
```
SELECT operation,
SUM(bytes_sent_size) AS total_bytes_out,
SUM(object_size) AS total_object_bytes,
COUNT(*) AS request_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT', 'REST.DELETE.OBJECT')
GROUP BY operation
ORDER BY total_bytes_out DESC;
```
**Example Objek terbesar yang dilayani**
```
SELECT key_name, MAX(object_size) AS max_size, AVG(object_size) AS avg_size, COUNT(*) AS reads
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation = 'REST.GET.OBJECT' AND bytes_sent_size > 0
GROUP BY key_name
ORDER BY max_size DESC
LIMIT 10;
```
## Analisis keamanan
**Example IP dengan tingkat kesalahan tinggi**
```
SELECT remote_ip,
COUNT(*) AS total,
SUM(CASE WHEN http_status >= 400 THEN 1 ELSE 0 END) AS errors
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY remote_ip
HAVING SUM(CASE WHEN http_status >= 400 THEN 1 ELSE 0 END) > 10
ORDER BY errors DESC;
```
**Example Upaya akses gagal dengan kunci**
```
SELECT remote_ip, key_name, operation, http_status, COUNT(*) AS attempts
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status >= 400
GROUP BY remote_ip, key_name, operation, http_status
ORDER BY attempts DESC
LIMIT 20;
```
**Example Distribusi versi TLS**
```
SELECT tls_version, COUNT(*) AS cnt
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY tls_version
ORDER BY cnt DESC;
```
## Menggunakan agen AI untuk menanyakan log akses server Amazon S3
MCP-compatible Agen AI dapat menemukan tabel S3 yang berisi log akses server Amazon S3 Anda, menghasilkan kueri SQL, dan menganalisis hasilnya. Karena log akses server Amazon S3 Anda diekspor sebagai tabel Iceberg di keranjang `aws-cloudwatch` tabel, agen dapat menanyainya melalui katalog Tabel S3 yang sama yang Anda gunakan dengan Amazon Athena, Amazon EMR, Amazon Redshift, atau alat apa pun. Iceberg-compatible
[Agen Toolkit untuk AWS](https://github.com/aws/agent-toolkit-for-aws) menyediakan keterampilan yang memberikan agen prosedur yang divalidasi untuk bekerja dengan AWS data. Keterampilan [tabel sistem Querying CloudWatch Logs](https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/system-table-skills/querying-aws-cloudwatch) menjalankan kueri SQL pada data CloudWatch Log yang diekspor ke Tabel S3, termasuk log akses server Amazon S3 Anda di bucket tabel. `aws-cloudwatch` Untuk menggunakannya, unduh keterampilan dari repositori GitHub dan tambahkan ke direktori keterampilan agen Anda.
Misalnya, Anda dapat meminta agen untuk menunjukkan 10 alamat IP sumber teratas berdasarkan jumlah permintaan di log akses server S3 Anda selama 24 jam terakhir. Agen menggunakan keterampilan untuk menemukan tabel log akses dan menjalankan kueri di Athena.