View a markdown version of this page

使用 CloudWatch Logs Insights 查詢日誌 - Amazon Simple Storage Service
開始使用流量分析故障診斷錯誤存取模式延遲分析成本歸因安全性分析

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

使用 CloudWatch Logs Insights 查詢日誌

CloudWatch Logs Insights 可讓您以互動方式搜尋和分析伺服器存取日誌資料。查詢會針對交付日誌的日誌群組執行，並在幾秒鐘內傳回結果。

注意

如需查詢傳送到 Amazon S3 一般用途儲存貯體的日誌，請參閱 使用 Amazon Athena 查詢請求的存取日誌。如需使用 SQL 查詢 S3 Tables 鏡像，請參閱 在 S3 資料表中查詢存取日誌。

開始使用

  1. 透過 https://console.aws.amazon.com/cloudwatch/ 開啟 CloudWatch 主控台。

  2. 在導覽窗格中，選擇日誌，然後選擇日誌洞見。

  3. 從日誌群組選取器中選取您的伺服器存取日誌群組。

  4. 為您的查詢選擇時間範圍。

  5. 輸入查詢，然後選擇執行查詢。

流量分析

下列查詢可協助您了解請求量和流量模式。

範例隨著時間的推移請求磁碟區
stats count(*) as requests by bin(5m) as interval
| sort interval asc
範例依操作類型請求混合
stats count(*) as cnt by operation
| sort cnt desc
範例依儲存貯體的流量
stats count(*) as requests, sum(bytes_sent_size) as bytes_out by bucket_arn
| sort requests desc

故障診斷錯誤

下列查詢可協助您識別和診斷錯誤。

範例錯誤率明細
filter http_status >= 400
| stats count(*) as error_count by http_status, error_code, operation
| sort error_count desc
範例 403 存取遭拒的請求
filter http_status = 403
| stats count(*) as denied_count by key_name, remote_ip, requester
| sort denied_count desc
範例 404 找不到請求
filter http_status = 404
| stats count(*) as miss_count by key_name, error_code, remote_ip
| sort miss_count desc
範例 503 SlowDown （調節） 事件
filter http_status = 503
| stats count(*) as throttle_count by key_name, remote_ip
| sort throttle_count desc

存取模式

下列查詢可協助您了解誰正在存取您的資料以及如何存取您的資料。

範例依來源 IP 的流量
stats count(*) as total_requests,
  sum(http_status >= 400) as errors,
  sum(bytes_sent_size) as bytes_transferred
  by remote_ip
| sort total_requests desc
範例依請求者的操作
stats count(*) as requests by requester, operation
| sort requests desc
範例最常存取的金鑰
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats count(*) as access_count, sum(bytes_sent_size) as bytes_out by key_name
| sort access_count desc
| limit 10

延遲分析

下列查詢可協助您識別慢速請求和延遲趨勢。

範例依操作類型的延遲
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms,
  pct(total_duration, 50) as p50_ms,
  pct(total_duration, 95) as p95_ms,
  max(total_duration) as max_ms,
  count(*) as requests
  by operation
範例 p95 延遲的最慢金鑰
filter operation like /REST\.GET\.OBJECT/
| stats avg(total_duration) as avg_ms,
  pct(total_duration, 95) as p95_ms,
  count(*) as requests
  by key_name
| sort p95_ms desc
| limit 10
範例隨著時間推移的延遲
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms, pct(total_duration, 95) as p95_ms by bin(5m) as interval
| sort interval asc

成本歸因

下列查詢可協助您了解資料傳輸並識別成本驅動因素。

範例依操作的資料傳輸
filter operation like /REST\.(GET|PUT|DELETE)\.OBJECT/
| stats sum(bytes_sent_size) as total_bytes_out,
  sum(object_size) as total_object_bytes,
  count(*) as request_count
  by operation
| sort total_bytes_out desc
範例正在服務的最大物件
filter operation like /REST\.GET\.OBJECT/ and bytes_sent_size > 0
| stats max(object_size) as max_size, avg(object_size) as avg_size, count(*) as reads by key_name
| sort max_size desc
| limit 10

安全性分析

下列查詢可協助您偵測可疑的存取模式。

範例錯誤率較高的 IPs
stats count(*) as total,
  sum(http_status >= 400) as errors
  by remote_ip
| filter errors > 10
| sort errors desc
範例依金鑰存取嘗試失敗
filter http_status >= 400
| stats count(*) as attempts by remote_ip, key_name, operation, http_status
| sort attempts desc
| limit 20
範例 TLS 版本分佈
stats count(*) as cnt by tls_version
| sort cnt desc