本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# 在 S3 資料表中查詢存取日誌
<a name="sal-cw-querying-s3tables"></a>

當您啟用 Amazon S3 Tables 整合時，Amazon CloudWatch Logs 會以 Apache Iceberg 格式將您的伺服器存取日誌傳送到`aws-cloudwatch`受管資料表儲存貯體。由於資料是 Iceberg 格式，因此您可以使用支援 Apache Iceberg 的任何工具來查詢資料，包括：
+ **Amazon Athena** – 使用 S3 Tables 目錄直接從 Athena 主控台執行 SQL 查詢。
+ **Amazon SageMaker Unified Studio** – 使用內建 SQL 編輯器來查詢您的日誌資料和其他分析工作負載。
+ **Amazon Redshift** – 透過 Redshift Spectrum 或直接整合查詢 Iceberg 資料表。
+ **Amazon EMR 上的 Apache Spark** – 使用 Spark SQL 或 DataFrame API 搭配 Iceberg 連接器。
+ **開放原始碼工具** – 支援 Apache Iceberg REST 目錄的任何工具，例如 Trino、DuckDB 或 PyIceberg。

**注意**  
如需在 CloudWatch Logs Insights （不含 SQL) 中以互動方式查詢日誌，請參閱 [使用 CloudWatch Logs Insights 查詢日誌](sal-cw-querying-insights.md)。

## 先決條件
<a name="sal-cw-s3tables-prerequisites"></a>

您必須先完成下列動作，才能查詢 S3 Tables 中的存取日誌：

1. **啟用 S3 Tables 整合。**請參閱 [啟用 S3 Tables 整合 （選用）](sal-cw-enabling.md#sal-cw-tables-integration)。

1. **啟用 S3 Tables 與分析服務的整合。**在 Amazon S3 主控台中，導覽至**資料表儲存貯**體，然後選擇**啟用整合**。這會在 Data Catalog `s3tablescatalog` 中建立聯合目錄，並讓分析服務可以看到您的資料表。根據預設，存取是透過 IAM 許可控制。您可以選擇使用 AWS Lake Formation 進行精細存取控制。如需詳細資訊，請參閱[將 S3 Tables 與 AWS 分析服務整合](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html)。

1. **等待資料填入。**資料通常會在第一次交付至 CloudWatch Logs 後的一小時內顯示。

## 連接 Amazon Athena
<a name="sal-cw-s3tables-athena-setup"></a>

1. 前往 [https://console.aws.amazon.com/athena/](https://console.aws.amazon.com/athena/) 開啟 Athena 主控台。

1. 在查詢編輯器中，從資料來源下拉式清單中選取 **Amazon S3 Tables** 目錄。

1. 您的日誌資料表會出現在 `logs` 命名空間下的資料庫清單中。

伺服器存取日誌的資料表名稱為 `amazon_s3__server_access`。完整資料表參考為：

```
"s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
```

## 流量分析
<a name="sal-cw-s3tables-traffic"></a>

**Example 隨著時間的推移請求磁碟區**  

```
SELECT date_trunc('minute', request_time) AS interval,
  COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY date_trunc('minute', request_time)
ORDER BY interval ASC;
```

**Example 依操作類型請求混合**  

```
SELECT operation, COUNT(*) AS cnt
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY operation
ORDER BY cnt DESC;
```

**Example 依儲存貯體的流量**  

```
SELECT bucket_arn, COUNT(*) AS requests, SUM(bytes_sent_size) AS bytes_out
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY bucket_arn
ORDER BY requests DESC;
```

## 故障診斷錯誤
<a name="sal-cw-s3tables-errors"></a>

**Example 錯誤率明細**  

```
SELECT http_status, error_code, operation, COUNT(*) AS error_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status >= 400
GROUP BY http_status, error_code, operation
ORDER BY error_count DESC;
```

**Example 403 存取遭拒的請求**  

```
SELECT key_name, remote_ip, requester, COUNT(*) AS denied_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status = 403
GROUP BY key_name, remote_ip, requester
ORDER BY denied_count DESC;
```

**Example 404 找不到請求**  

```
SELECT key_name, error_code, remote_ip, COUNT(*) AS miss_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status = 404
GROUP BY key_name, error_code, remote_ip
ORDER BY miss_count DESC;
```

**Example 503 SlowDown （調節） 事件**  

```
SELECT key_name, remote_ip, COUNT(*) AS throttle_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status = 503
GROUP BY key_name, remote_ip
ORDER BY throttle_count DESC;
```

## 存取模式
<a name="sal-cw-s3tables-access"></a>

**Example 依來源 IP 的流量**  

```
SELECT remote_ip,
  COUNT(*) AS total_requests,
  SUM(CASE WHEN http_status >= 400 THEN 1 ELSE 0 END) AS errors,
  SUM(bytes_sent_size) AS bytes_transferred
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY remote_ip
ORDER BY total_requests DESC;
```

**Example 依請求者的操作**  

```
SELECT requester, operation, COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY requester, operation
ORDER BY requests DESC;
```

**Example 最常存取的金鑰**  

```
SELECT key_name, COUNT(*) AS access_count, SUM(bytes_sent_size) AS bytes_out
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT')
GROUP BY key_name
ORDER BY access_count DESC
LIMIT 10;
```

## 延遲分析
<a name="sal-cw-s3tables-latency"></a>

**Example 依操作類型的延遲**  

```
SELECT operation,
  AVG(total_duration) AS avg_ms,
  APPROX_PERCENTILE(total_duration, 0.5) AS p50_ms,
  APPROX_PERCENTILE(total_duration, 0.95) AS p95_ms,
  MAX(total_duration) AS max_ms,
  COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT')
GROUP BY operation;
```

**Example p95 延遲的最慢金鑰**  

```
SELECT key_name,
  AVG(total_duration) AS avg_ms,
  APPROX_PERCENTILE(total_duration, 0.95) AS p95_ms,
  COUNT(*) AS requests
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation = 'REST.GET.OBJECT'
GROUP BY key_name
ORDER BY p95_ms DESC
LIMIT 10;
```

**Example 隨著時間推移的延遲**  

```
SELECT date_trunc('minute', request_time) AS interval,
  AVG(total_duration) AS avg_ms,
  APPROX_PERCENTILE(total_duration, 0.95) AS p95_ms
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT')
GROUP BY date_trunc('minute', request_time)
ORDER BY interval ASC;
```

## 成本歸因
<a name="sal-cw-s3tables-cost"></a>

**Example 依操作的資料傳輸**  

```
SELECT operation,
  SUM(bytes_sent_size) AS total_bytes_out,
  SUM(object_size) AS total_object_bytes,
  COUNT(*) AS request_count
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation IN ('REST.GET.OBJECT', 'REST.PUT.OBJECT', 'REST.DELETE.OBJECT')
GROUP BY operation
ORDER BY total_bytes_out DESC;
```

**Example 正在服務的最大物件**  

```
SELECT key_name, MAX(object_size) AS max_size, AVG(object_size) AS avg_size, COUNT(*) AS reads
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE operation = 'REST.GET.OBJECT' AND bytes_sent_size > 0
GROUP BY key_name
ORDER BY max_size DESC
LIMIT 10;
```

## 安全性分析
<a name="sal-cw-s3tables-security"></a>

**Example 錯誤率較高的 IPs**  

```
SELECT remote_ip,
  COUNT(*) AS total,
  SUM(CASE WHEN http_status >= 400 THEN 1 ELSE 0 END) AS errors
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY remote_ip
HAVING SUM(CASE WHEN http_status >= 400 THEN 1 ELSE 0 END) > 10
ORDER BY errors DESC;
```

**Example 依金鑰存取嘗試失敗**  

```
SELECT remote_ip, key_name, operation, http_status, COUNT(*) AS attempts
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
WHERE http_status >= 400
GROUP BY remote_ip, key_name, operation, http_status
ORDER BY attempts DESC
LIMIT 20;
```

**Example TLS 版本分佈**  

```
SELECT tls_version, COUNT(*) AS cnt
FROM "s3tablescatalog/aws-cloudwatch"."logs"."amazon_s3__server_access"
GROUP BY tls_version
ORDER BY cnt DESC;
```

## 使用 AI 代理器查詢 Amazon S3 伺服器存取日誌
<a name="sal-cw-s3tables-ai-agents"></a>

與 MCP 相容的 AI 代理器可以探索包含 Amazon S3 伺服器存取日誌的 S3 資料表、產生 SQL 查詢，並分析結果。 Amazon S3 由於您的 Amazon S3 伺服器存取日誌會匯出為`aws-cloudwatch`資料表儲存貯體中的 Iceberg 資料表，因此客服人員可以透過與 Amazon Athena、Amazon EMR、Amazon Redshift 或任何 Iceberg 相容工具搭配使用的相同 S3 Tables 目錄來查詢它們。

Agent [Toolkit for AWS](https://github.com/aws/agent-toolkit-for-aws) 提供技能，可讓客服人員驗證使用 AWS 資料的程序。[查詢 CloudWatch Logs 系統資料表](https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/system-table-skills/querying-aws-cloudwatch)技能會在匯出至 S3 Tables 的 CloudWatch Logs 資料上執行 SQL 查詢，包括`aws-cloudwatch`資料表儲存貯體中的 Amazon S3 伺服器存取日誌。若要使用它，請從 GitHub 上的儲存庫下載技能，並將其新增至代理程式的技能目錄。

例如，您可以要求 代理程式根據過去 24 小時內 S3 伺服器存取日誌中的請求計數顯示前 10 個來源 IP 地址。代理程式會使用 技能來尋找存取日誌資料表，並在 Athena 中執行查詢。